Exploit for CVE-2026-19089

CVE-2026-19089 — WooCommerce Tyche Product Input Fields S...

CVE-2026-19089

creationtimestamp| type| source ---|---|--- 2026-08-12 19:00:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msvssyzrsq25 2026-09-09 04:00:24+00:00| seen| Telegram/XaMpjSHHxdFz0-yBA1eCpiXEPPhqtMXTtWzkO6WcDwZaaU 2026-09-09 10:00:06+00:00| seen|...

CVE-2026-19089 Product Input Fields for WooCommerce < 2.0.2 - Unauthenticated Arbitrary File Upload

The Product Input Fields for WooCommerce WordPress plugin before 2.0.2 does not validate uploaded file types when its accepted-types setting is left empty, which its own documentation advertises as accepting all files, allowing unauthenticated attackers to upload arbitrary files and achieve remot...