Exploit discussion active in current signal (2 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
The Product Input Fields for WooCommerce WordPress plugin before 2.0.2 does not validate uploaded file types when its accepted-types setting is left empty, which its own documentation advertises as accepting all files, allowing unauthenticated attackers to upload arbitrary files and achieve remote code execution on servers that do not honour the directory's access rules.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
NONE
CVE-2026-19089 – WooCommerce Tyche RCE PoC (WIP) https://github.com/abraxas/CVE-2026-19089-WooCommerce-Tyche
Post summary
The post announces a proof‑of‑concept for CVE‑2026‑19089, indicating a remote code execution flaw in WooCommerce Tyche, and provides a GitHub link with PoC code.
spicy 0day, coming right up! woocommerce tyche RCE. https://github.com/abraxas/CVE-2026-19089-WooCommerce-Tyche https://t.co/3saaUo27su
Post summary
The tweet announces an RCE vulnerability in WooCommerce Tyche accompanied by a GitHub repository hosting a PoC, but provides no signs of active exploitation or available patches.