CVE-2026-14270 describes an arbitrary file upload vulnerability in the Extra Checkout Options addon for the Extra Product Options plugin for WooCommerce on WordPress. The flaw is due to missing authorization and nonce validation in the eco_save_settings() function, which permits low-privileged authenticated users (Subscriber level and above) to modify the upload allowlist setting (tc_eco_custom_file_types). Additionally, insufficient authorization on the wc_eco_upload_file AJAX action allows these users to upload PHP files using a frontend upload nonce exposed on cart and checkout pages. Successful exploitation can lead to remote code execution. The vulnerability affects all versions up to and including 2.3.2, with a partial fix applied in 2.3.2. No confirmed full patch or official remediation level is provided in the available data.

An attacker with low-privileged authenticated access can upload arbitrary PHP files, leading to remote code execution on the affected WordPress site. This compromises confidentiality, integrity, and availability of the system, allowing full control by the attacker. The CVSS 3.1 score is 8.8 (high severity), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability was partially fixed in version 2.3.2, but no official full fix or remediation level is documented. Until a confirmed patch is available, restrict authenticated user roles to trusted users only and monitor for suspicious file uploads. Follow vendor advisories closely for updates.