CVE-2026-39499: WordPress Advanced Product Fields (Product Addons) for WooCommerce plugin <= 1.6.19 - PHP Object Injection vulnerability

Synopsis

PHP Object Injection in the Advanced Product Fields (Product Addons) for WooCommerce plugin (versions up to and including 1.6.19) allows a network-accessible attacker with shop manager credentials to inject malicious PHP objects into the application. Exploitation requires a high-privilege account but no victim interaction, and successful attacks give the attacker full read, write, and availability impact over the affected WordPress installation. No fix version has been published yet; HarborGuard is tracking the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the WordPress service over the network; there is no requirement for local or physical access.

• AuthenticationRequired

  A shop manager account (or higher) is required; any credential at that privilege level is sufficient to attempt exploitation.

• Victim interactionNot required

  No victim action such as clicking a link or opening a file is needed; the attacker operates entirely on their own.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layout, or other variable environmental factors.

Blast Radius

• A successful attacker reads sensitive data from the WordPress installation, including stored order records, customer personal information, and configuration secrets.
• The attacker writes or modifies persisted database rows and plugin configuration, enabling persistent backdoors or data tampering.
• The attacker can crash or degrade the affected WordPress service, disrupting storefront availability for customers.
• Because PHP Object Injection can chain into arbitrary code execution via existing class gadgets, the attacker may gain operating-system-level command execution inside the container.