CVE-2026-4001 - Vulnerability Analysis

Overview

Woocommerce Custom Product Addons Pro for WordPress <= 5.4.1 contains a remote code execution caused by insufficient sanitization of user-submitted field values in custom pricing formula eval() in process_custom_formula(), letting unauthenticated attackers execute arbitrary code remotely, exploit requires crafted input in custom pricing formula field.

Severity & Score

Impact

Unauthenticated attackers can execute arbitrary code on the server, potentially leading to full system compromise.

Mitigation

Update to the latest version of Woocommerce Custom Product Addons Pro.

References

• https://acowebs.com/woo-custom-product-addons/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/70a2b6ff-defc-4722-9af9-3cae94e98632?source=cve

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 24, 2026

🔴 CVE-2026-4001 - Critical (9.8) The Woocommerce Custom Product Addons Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 5.4.1 via the custom pricing formula eval() in the process_custom_formula() function within includes/proces... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4001/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner