BaseFortifyCVE-2026-4001 (CRITICAL 9.8)
WooCommerce Custom Product Addons Pro allows unauthenticated RCE via eval() misuse.
🔎 Full analysis:
https://basefortify.eu/cve_reports/2026/03/cve-2026-4001.html
Technical details:
• CWE-95: eval() injection
• User input passed to PHP eval()
• No proper sanitization/escaping
• Works without authentication
Impact: Full server takeover
Mitigation:
• Update plugin immediately (if patch available)
• Disable custom pricing formulas
• Restrict public input fields
• Monitor for suspicious requests
BaseFortify helps detect & prioritize risks:
https://basefortify.eu/
