CVE-2026-19089

The affected product is the Product Input Fields for WooCommerce WordPress plugin. The vulnerability stems from the plugin not validating uploaded file types when the accepted-types setting is left empty, contradicting its documentation that it accepts all files. This allows unauthenticated attac...