CVE-2026-73181

Unauthenticated Arbitrary File Download in Extra Product Options & Add-Ons for WooCommerce < 7.6 versions.

Credits

daroo | Patchstack Bug Bounty Program

References

https://patchstack.com/database/wordpress/plugin/woocommerce-tm-extra-product-options/vulnerability/wordpress-extra-product-options-add-ons-for-woocommerce-plugin-7-6-arbitrary-file-download-vulnerability?_s_id=cve