SZB-ebe2177b27
EUVD-2026-112986 reports PHP object injection in Extra Fees Plugin for WooCommerce
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- Dotstore
- Product
- Extra Fees Plugin for WooCommerce
- First seen
Summary
The EU Vulnerability Database (EUVD) lists a PHP object injection flaw, scored 8.8 (CVSS v3.1), in Extra Fees Plugin for WooCommerce up to version 4.4.0. The listing was published 2026-10-29 and updated 2026-10-30.
If you use Dotstore
Update Extra Fees Plugin for WooCommerce to the latest vendor release
Restrict contributor-level accounts to trusted users until patched
Check the vendor's advisory for the fixed version
What the sources say 1
· Mastodon: “Contributor PHP Object Injection in Extra Fees Plugin for WooCommerce <= 4.4.0 versions.” Source