CVE-2026-19089 describes a vulnerability in the Product Input Fields for WooCommerce WordPress plugin prior to version 2.0.2. When the accepted-types setting is left empty, the plugin fails to validate the types of files uploaded through product input fields. This lack of validation permits unauthenticated attackers to upload files of any type, including potentially malicious files. If the server hosting the plugin does not properly enforce directory access rules, attackers may achieve remote code execution by executing these uploaded files.

An unauthenticated attacker can upload arbitrary files to the server via the vulnerable plugin, potentially leading to remote code execution if the server does not properly restrict access to uploaded files. This can compromise the server and the website running WooCommerce, leading to full system compromise or data theft.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should avoid leaving the accepted-types setting empty and restrict file uploads to safe types only. Additionally, ensure that server directory access rules are properly configured to prevent execution of uploaded files.