Magneto-PolyShell

Magento 2 RCE Exploit - Unauthenticated File Upload to RCE ⚠️ This tool is for educational and authorized security testing only. Unauthorized use against systems you do not own is illegal. This exploit targets a critical unauthenticated remote code execution RCE vulnerability in Magento 2 Adobe...

WordPress Extra Product Options Builder for WooCommerce plugin < 1.2.176 - Unauthenticated Customer File Disclosure via getpublicfileupload vulnerability

Unauthenticated Customer File Disclosure via getpublicfileupload vulnerability discovered by Farid Narimanov in WordPress Plugin Extra Product Options Builder for WooCommerce versions 1.2.176...

CVE-2026-73181

Unauthenticated Arbitrary File Download in Extra Product Options & Add-Ons for WooCommerce 7.6 versions...

CVE-2026-73181

Extra Product Options & Add-Ons for WooCommerce plugin versions below 7.6 allow unauthenticated attackers to download arbitrary files, exposing sensitive data with CVSS 7.5 (HIGH). PatchStack reports the flaw; no exploit code is provided. Upgrade to version 7.6 or later to remediate. Exploitation...

EUVD-2026-60937

Unauthenticated Arbitrary File Download in Extra Product Options & Add-Ons for WooCommerce 7.6 versions...

CVE-2026-73181 WordPress Extra Product Options & Add-Ons for WooCommerce plugin < 7.6 - Arbitrary File Download vulnerability

Unauthenticated Arbitrary File Download in Extra Product Options & Add-Ons for WooCommerce 7.6 versions...

CVE-2026-73181 WordPress Extra Product Options & Add-Ons for WooCommerce plugin < 7.6 - Arbitrary File Download vulnerability

Unauthenticated Arbitrary File Download in Extra Product Options & Add-Ons for WooCommerce 7.6 versions...

CVE-2026-73181

Unauthenticated Arbitrary File Download in Extra Product Options & Add-Ons for WooCommerce 7.6 versions...

PT-2026-77080

Unauthenticated Arbitrary File Download in Extra Product Options & Add-Ons for WooCommerce 7.6 versions...

CVE-2026-73181: Improper Limitation of a Pathname to a Restricted Directory

Unauthenticated Arbitrary File Download in Extra Product Options & Add-Ons for WooCommerce 7.6 versions...

CVE-2026-19728

The Extra Product Options Builder for WooCommerce WordPress plugin before 1.2.176 does not verify that the requester is entitled to a customer-uploaded file before serving it, allowing unauthenticated users who obtain a file's stored name to retrieve it. The Extra Product Options Builder for...

CVE-2026-19728 Extra Product Options Builder for WooCommerce < 1.2.176 - Unauthenticated Customer File Disclosure via getpublicfileupload

The Extra Product Options Builder for WooCommerce WordPress plugin before 1.2.176 does not verify that the requester is entitled to a customer-uploaded file before serving it, allowing unauthenticated users who obtain a file's stored name to retrieve it. The Extra Product Options Builder for...

CVE-2026-19728

The Extra Product Options Builder for WooCommerce WordPress plugin, in versions prior to 1.2.176 , contains a vulnerability where it fails to verify if a requester is authorized to access customer-uploaded files. This allows unauthenticated users to retrieve files if they know the stored filename...

CVE-2026-19728 Extra Product Options Builder for WooCommerce < 1.2.176 - Unauthenticated Customer File Disclosure via getpublicfileupload

The Extra Product Options Builder for WooCommerce WordPress plugin before 1.2.176 does not verify that the requester is entitled to a customer-uploaded file before serving it, allowing unauthenticated users who obtain a file's stored name to retrieve it. The Extra Product Options Builder for...

EUVD-2026-59920

The Extra Product Options Builder for WooCommerce WordPress plugin before 1.2.176 does not verify that the requester is entitled to a customer-uploaded file before serving it, allowing unauthenticated users who obtain a file's stored name to retrieve it. The Extra Product Options Builder for...

CVE-2026-19728

The Extra Product Options Builder for WooCommerce WordPress plugin before 1.2.176 does not verify that the requester is entitled to a customer-uploaded file before serving it, allowing unauthenticated users who obtain a file's stored name to retrieve it. The Extra Product Options Builder for...

CVE-2026-19728: Missing Authorization

The Extra Product Options Builder for WooCommerce WordPress plugin before 1.2.176 does not verify that the requester is entitled to a customer-uploaded file before serving it, allowing unauthenticated users who obtain a file's stored name to retrieve it. The Extra Product Options Builder for...

PT-2026-73128

The Extra Product Options Builder for WooCommerce WordPress plugin before 1.2.176 does not verify that the requester is entitled to a customer-uploaded file before serving it, allowing unauthenticated users who obtain a file's stored name to retrieve it. The Extra Product Options Builder for...

WordPress Extra Product Options & Add-Ons for WooCommerce plugin < 7.6 - Arbitrary File Download vulnerability

Arbitrary File Download vulnerability discovered by daroo in WordPress Plugin Extra Product Options & Add-Ons for WooCommerce versions 7.6...

WordPress Extra Checkout Options - addon for Extra Product Options plugin plugin <= 2.3.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload in eco_save_settings vulnerability

WordPress Extra Checkout Options - addon for Extra Product Options plugin plugin = 2.3.2 - Missing Authorization to Authenticated Subscriber+ Arbitrary File Upload in ecosavesettings vulnerability discovered by bashu in WordPress Plugin Extra Checkout Options - addon for Extra Product Options...