CVE Field Guide
About Us
CVE-2026-116866
PUBLISHED
WordPress Extra Fees Plugin for WooCommerce plugin <= 4.4.0 - PHP Object Injection vulnerability
Assigner:
Patchstack
Reserved:
27.10.2026
Published:
29.10.2026
Updated:
29.10.2026
Contributor PHP Object Injection in Extra Fees Plugin for WooCommerce <= 4.4.0 versions.
Metrics
CVSS 3.1
CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS Score:
8.8
CVSS score
8.8
Attack Vector
Network
Scope
Unchanged
Attack Complexity
Low
Confidentiality Impact
High
Privileges Required
Low
Integrity Impact
High
User Interaction
None
Availability Impact
High
CVSS 3.1
Product Status
Vendor
Dotstore
Product
Extra Fees Plugin for WooCommerce
Versions
Default:
unaffected
affected from n/a to 4.4.0 (incl.)
Credits
Ananda Dhakal (Patchstack) | Patchstack Bug Bounty Program
finder
References
https://patchstack.com/database/wordpress/plugin/woo-conditional-product-fees-for-checkout/vulnerability/wordpress-extra-fees-plugin-for-woocommerce-plugin-4-4-0-php-object-injection-vulnerability?_s_id=cve
Problem Types
CWE-502 Deserialization of Untrusted Data
CWE
Impacts
CAPEC-586 Object Injection