WooCommerce Product Addons Bypass Enables Unauthorized Purchase Discounts

The Advanced Product Fields (Product Addons) for WooCommerce plugin for WordPress is vulnerable to Improper Input Validation in all versions up to, and including, 1.6.21. This is due to a logic flaw in the 'validate_cart_data' function. This makes it possible for unauthenticated attackers to bypass required paid addons and complete purchases at the base product price only, effectively stealing products by paying a fraction of the intended total. The vulnerability was partially patched in version 1.6.19.

Casky was already ahead

This CVE exploits attack patterns that Casky's 322matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The Advanced Product Fields (Product Addons) plugin for WooCommerce contains a critical input validation flaw in its 'validate_cart_data' function that allows unauthenticated attackers to circumvent mandatory paid addon requirements. By exploiting improper validation logic, threat actors can complete purchases at artificially reduced prices, paying only for base products while obtaining premium addons for free. This vulnerability affects all WooCommerce stores using versions 1.6.21 and earlier of this popular e-commerce plugin, directly impacting revenue streams and inventory control for thousands of online retailers. The ability to bypass payment requirements represents a severe business logic vulnerability with immediate financial consequences.

Casky's 754 security skills, powered by Claude AI's extended reasoning, map this vulnerability across MITRE ATT&CK Initial Access (TA0001) and Resource Development (TA0043) techniques. Practitioners using Casky would identify attack patterns including suspicious cart manipulation requests, repeated checkout attempts with inconsistent pricing calculations, and transaction logs showing paid addons marked as fulfilled without corresponding payment records. The platform's CWE-20 input validation detection would flag the 'validate_cart_data' function's failure to properly sanitize cart object parameters. Practitioners would observe anomalous order patterns—legitimate orders with addon discrepancies, bulk low-value transactions, or geographic clustering of abuse—indicating active exploitation. The extended reasoning capability helps correlate these indicators across order databases and payment logs to distinguish genuine use cases from systematic abuse.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

322 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-2996.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-2996

Casky has 322 skills that investigate the attack patterns behind CVE-2026-2996. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn