Custom Fields for WooCommerce < 1.5.1 – Unauthenticated Arbitrary File Deletion via Path Traversal | CVE 2026-16940

Description

The plugin does not validate a user-supplied file path before deletion, allowing unauthenticated users to delete arbitrary files on the server (such as wp-config.php), which can lead to a full site takeover.

Proof of Concept

The PoC will be displayed on August 10, 2026, to give users the time to update.

Affects Plugins

addify-custom-fields-for-woocommerce

Fixed in 1.5.1

References

CVE

CVE-2026-16940

Classification

Type

TRAVERSAL

OWASP top 10

A1: Injection

CWE

CWE-22

CVSS

10.0 (critical)

Miscellaneous

Original Researcher

Mike Gozdiskowski

Submitter

Mike Gozdiskowski

Verified

Yes

WPVDB ID

a315a6ac-3ffb-4735-92ca-6e85338f8807

Timeline

Publicly Published

2026-07-27 (about 9 days ago)

Added

2026-07-27 (about 8 days ago)

Last Updated

2026-08-04 (about 9 hours ago)

Other

Published

Title

Published

2023-06-22

Title

Ninja Forms < 3.6.25 - Admin+ Arbitrary File Deletion

Published

2019-07-12

Title

Ad Inserter <= 2.4.19 - Authenticated Path Traversal

Published

2025-09-16

Title

OrderConvo < 14 - Unauthenticated Arbitrary File Read

Published

2025-02-13

Title

Bit Assist < 1.5.3 - Admin+ Arbitrary File Read

Published

2023-08-14

Title

Orders Tracking for WooCommerce < 1.2.6 - Admin+ Arbitrary File Access/Read