An authenticated code injection vulnerability in the Acowebs Product Addons for Woocommerce plugin allows attackers with Shop Manager privileges to execute arbitrary PHP code on the server.

This vulnerability occurs because the evalConditions function fails to sanitize the operator field in conditional logic rules, passing it directly to the PHP eval function. Successful exploitation requires an attacker to hold Shop Manager-level access or higher to inject and execute malicious code during the saving of addon form field rules.

The ability to execute arbitrary PHP code allows an attacker to achieve full remote code execution on the underlying WordPress server. This level of access typically results in complete system compromise, including the theft of customer data, unauthorized modification of site content, and potential lateral movement into the broader network environment. With a CVSS score of 7.2, this vulnerability represents a high-severity risk to business continuity and data integrity.

Immediate Action: Update the Acowebs Product Addons for Woocommerce – Product Options with Custom Fields plugin to the latest version, ensuring all installations are beyond version 3.1.0.

Proactive Monitoring: Monitor server access logs and WordPress administrative logs for suspicious activity originating from accounts with Shop Manager or administrator privileges.

Compensating Controls: Implement a Web Application Firewall with rules configured to detect and block malicious payloads directed at PHP evaluation functions or suspicious input within plugin settings.

Public Exploit Available: Unknown

Given the potential for full server compromise, security teams should prioritize patching this plugin immediately. Organizations that cannot update the plugin should restrict administrative access to a minimal number of trusted users and audit existing addon form field configurations for unauthorized modifications.