CVE-2026-19802

The Checkout Custom Fields Builder for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated...

WordPress Checkout Custom Fields Builder for WooCommerce plugin <= 1.1.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary Plugin Installation vulnerability discovered by Nabil Irawan in WordPress Plugin Checkout Custom Fields Builder for WooCommerce versions = 1.1.5...