{"id":"CVE-2026-119171","published":"2026-11-11T08:17:17.297","lastModified":"2026-11-11T08:17:17.297","description":"The Advanced Product Fields (Product Addons) for WooCommerce WordPress plugin from 1.6.22 to 1.7.3 does not validate that a submitted value for a required paid product option matches one of the configured choices, only that it is not empty, allowing unauthenticated users to add a product to the cart and complete an order while skipping the required option's surcharge and paying only the base product price.","cvssScore":5.3,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","cwes":[],"vendors":[],"products":[],"references":[{"url":"https://wpscan.com/vulnerability/e02cc0f2-9f10-4114-b9b5-1e1a2ae18355/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}