---
id: CVE-2026-19802
title: >-
  The Checkout Custom Fields Builder for WooCommerce plugin for WordPress is
  vulnerable to authorization bypass in all versions up to, and including, 1.1.5
summary: >-
  The Checkout Custom Fields Builder for WooCommerce plugin for WordPress is
  vulnerable to authorization bypass in all versions up to, and including,
  1.1.5. This is due to the plugin not properly verifying that a user is
  authorized to perf…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'
cwe:
  - CWE-862
vendor: stylemix
product: Checkout Custom Fields Builder for WooCommerce
affected:
  - checkout_custom_fields_builder_for_woocommerce <= 1.1.5
published: '2026-09-09'
updated: '2026-09-09'
sourceUpdated: '2026-09-09T16:17:02.130'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-19802'
references:
  - url: >-
      https://plugins.trac.wordpress.org/browser/checkout-custom-fields-builder-for-woocommerce/tags/1.1.4/includes/Load.php#L150
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/browser/checkout-custom-fields-builder-for-woocommerce/tags/1.1.4/includes/Load.php#L168
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/browser/checkout-custom-fields-builder-for-woocommerce/tags/1.1.4/includes/Load.php#L195
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/browser/checkout-custom-fields-builder-for-woocommerce/tags/1.1.4/includes/Load.php#L47
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/changeset?reponame=&old=3678996%40checkout-custom-fields-builder-for-woocommerce&new=3678996%40checkout-custom-fields-builder-for-woocommerce
    label: security@wordfence.com
  - url: >-
      https://www.wordfence.com/threat-intel/vulnerabilities/id/6d780de5-d333-4af9-b9d8-0d6c8254dd05?source=cve
    label: security@wordfence.com
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-09T15:00:42.550619Z'
epss: 0.00425
epssPercentile: 0.34039
ingestedAt: '2026-09-09T07:03:03.596Z'
---

## Overview

The Checkout Custom Fields Builder for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to install and activate an arbitrary attacker-hosted plugin, resulting in remote code execution on the server. The required nonce is emitted inline on all admin pages accessible to subscribers when WooCommerce is inactive, meaning any subscriber-level user can harvest it and trigger the exploit without any additional privileges.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.