Extra Fees Plugin for WooCommerce (<= 4.4.0) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/extra-fees-plugin-for-woocommerce--4.4.0/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 29 Oct 2026 17:36:16 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgExtra Fees Plugin for WooCommerce: PHP Object Injection (CVE-2026-116866)https://feed.craftedsignal.io/briefs/2026-10-extra-fees-injection/Thu, 29 Oct 2026 17:36:16 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-extra-fees-injection/The Extra Fees Plugin for WooCommerce versions 4.4.0 and below contains a contributor-level PHP object injection vulnerability.<p>Extra Fees Plugin for WooCommerce versions 4.4.0 and earlier are vulnerable to a PHP object injection flaw that can be triggered by a contributor-level user.</p> highadvisoryweb-vulnerabilityphp-injectionwordpress