CVE-2026-116866

HighCVSS 8.8

Published: 29/10/2026(UTC)Updated: 30/10/2026(UTC)Translated: 29/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.29%

21th percentile - higher than 21% of all known CVEs

Summary

The Extra Fees Plugin for WooCommerce in versions up to and including 4.4.0 contains a PHP Object Injection vulnerability exploitable by a user with Contributor privileges. The flaw allows injection of a malicious PHP object, potentially leading to further attacks depending on available gadgets.

Risk Assessment

A Contributor-level user could exploit this to escalate privileges or perform unauthorized actions within the WordPress/WooCommerce context. This may compromise the confidentiality and integrity of store data.

Recommendation

Update the Extra Fees Plugin for WooCommerce to a version later than 4.4.0 that fixes the vulnerability. Until then, limit the number of accounts with Contributor privileges.

Other vulnerabilities in Extra Fees Plugin for WooCommerce

CVE-2026-39671High
Cross-Site Request Forgery (CSRF) vulnerability in Dotstore Extra Fees Plugin for WooCommerce woo-conditional-product-fees-for-checkout allows Cross Site Request Forgery. This issue affects Extra Fees Plugin for WooCommerce: from n/a through <= 4.3.3.

Original NVD description (English source)

Contributor PHP Object Injection in Extra Fees Plugin for WooCommerce <= 4.4.0 versions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS