HIGHVulnerability
Verified
Global

NVD HIGH: CVE-2026-14270 — The Extra Checkout Options (addon for Extra Product Options & Add-Ons for WooCom...

·Source: NIST NVD

Updated:

Executive Summary

The Extra Checkout Options (addon for Extra Product Options & Add-Ons for WooCommerce) plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.3.2. This is due to missing authorization and nonce validation in the eco_save_settings() function, which allows low-privileged authenticated users to modify the tc_eco_custom_file_types upload allowlist setting,

Analysis

The Extra Checkout Options (addon for Extra Product Options & Add-Ons for WooCommerce) plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.3.2. This is due to missing authorization and nonce validation in the eco_save_settings() function, which allows low-privileged authenticated users to modify the tc_eco_custom_file_types upload allowlist setting, combined with insufficient authorization on the wc_eco_upload_file AJAX action. This makes it possible for authenticated attackers, with Subscriber-level access and above, to allow PHP uploads, upload a PHP file using the frontend upload nonce exposed on cart and checkout pages, and achieve remote code execution. NOTE: This vulnerability was partially fixed in version 2.3.2. CVSS Score: 8.8. Published: 2026-07-29T12:16:35.697.

Indicators of Compromise (1)

CVE (1)
CVE-2026-14270
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Jul 29, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerabilityNEW

BBVA acquires SocGen's 50% stake in brokerage joint venture Altura Markets

BBVA has reached an agreement with Société Générale (SG) to integrate Altura Markets into the BBVA Group by acquiring the 50 percent stake currently owned by the French bank, becoming the company's sole shareholder. The transaction is subject to the relevant regulatory approvals.

Finextra
MEDIUMVulnerabilityNEW

Chinese Threat Actor Uses Leaked DarkSword Kit to Deploy GHOSTBLADE on iOS

An unknown Chinese-threat actor has been observed running a campaign targeting Apple iOS devices by leveraging a publicly leaked version of the DarkSword exploit kit. Attack surface management platform Censys said it identified the threat actor running more than 100 web properties, most of which are fake Amazon Web Services (AWS) sign-in pages on a domain that also hosts the exploit toolkit. "

The Hacker News
MEDIUMVulnerabilityNEW

FCA streamlines transaction reporting obligations

Transaction reporting requirements become smarter, simpler and more proportionate under new rules from the FCA.

Finextra