CVE-2026-102392

The vulnerability affects the Extra Product Options for WooCommerce and Custom Product Addons and Fields plugins, specifically in versions up to 3.3.8, allowing for PHP Object Injection. This could lead to remote code execution, enabling attackers to execute arbitrary PHP code on the server. E-commerce businesses using these plugins should prioritize patching to mitigate potential exploitation risks.