⚠ Critical — coordinated disclosure (embargoed) Disclosed 2026-10-24 · coordinated disclosure
Identity withheld until 2027-01-22 (90 days). The maintainer/vendor was notified on 2026-10-24 and has a 90-day window to remediate before the affected software is named. This page is unlisted and not indexed until then. codelake never stores raw secrets.
Advisory · CLR-2026-3670

Unauthenticated remote code execution in a WooCommerce product-configurator plugin

A critical unauthenticated PHP code-injection vulnerability reachable by any unauthenticated site visitor. The vendor has been notified under a 90-day coordinated-disclosure window; the affected software and technical detail are revealed automatically on the reveal date.

CriticalCoordinated disclosure
Overview

codelake Research identified a critical, unauthenticated remote code execution vulnerability in a WooCommerce product-configurator plugin. The flaw is reachable by any unauthenticated visitor and allows execution of arbitrary PHP on the hosting server.

An unauthenticated WordPress AJAX endpoint passes attacker-controlled request input, without numeric sanitisation, into a PHP eval() used for price calculation. A crafted request yields arbitrary PHP execution (full server compromise).

Affected: all current versions. No fixed version was available at the time of disclosure.

CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8, Critical).

Technical detail
🔒
Technical detail withheld until 2027-01-22 (90 days). The affected package, version, vulnerability class and remediation are public on this page. The exact code location, sink and reproduction are held back to limit exploitation while the issue is unpatched, and are revealed automatically once the coordinated-disclosure window closes.
Remediation
🔒
Technical detail withheld until 2027-01-22 (90 days). The affected package, version, vulnerability class and remediation are public on this page. The exact code location, sink and reproduction are held back to limit exploitation while the issue is unpatched, and are revealed automatically once the coordinated-disclosure window closes.

Reported by codelake Research (https://research.codelake.dev) under coordinated disclosure. The affected software's identity and the exact technical detail are withheld until the reveal date to limit exploitation of an unpatched issue, then revealed automatically.