Arbitrary File Upload

Overview Affected versions of this package are vulnerable to Arbitrary File Upload via the assets or files fields in frontend forms. An attacker can upload disallowed file types by submitting specially crafted files through these fields, potentially bypassing intended administrative restrictions...

CVE-2026-14270

Affected product: Extra Checkout Options addon for Extra Product Options & Add-Ons for WooCommerce (WordPress). Vulnerability: Arbitrary File Upload in all versions up to 2.3.2 due to missing authorization and nonce validation in eco_save_settings, enabling low-privileged authenticated users to m...