CVE-2026-19728 is a missing authorization vulnerability (CWE-862) in the Extra Product Options Builder for WooCommerce WordPress plugin versions prior to 1.2.176. The plugin fails to verify that a requester is authorized to access customer-uploaded files before serving them. While the plugin writes a deny-all rule to upload directories to prevent unauthorized access, this protection depends on the web server honoring such rules (e.g., Apache). On servers that do not honor these rules, such as default nginx configurations, the files are already accessible at their direct URLs, so the vulnerability does not increase exposure in those environments.

An unauthenticated attacker who knows or can guess the stored name of a customer-uploaded file can retrieve that file without authorization. This leads to unauthorized disclosure of potentially sensitive customer-uploaded content. The impact is limited by the web server configuration: servers honoring the deny-all rule reduce exposure, while those that do not honor it already serve these files directly, so the vulnerability does not increase risk in those cases.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should verify their web server configuration to ensure that deny-all rules in upload directories are enforced (e.g., Apache). For servers like nginx that ignore these rules by default, additional access controls should be implemented to restrict unauthorized file access. Monitor vendor communications for an official patch or update.