CVE-2026-19728 is a missing authorization vulnerability (CWE-862) in the Extra Product Options Builder for WooCommerce WordPress plugin versions prior to 1.2.176. The plugin fails to verify that a requester is authorized to access customer-uploaded files before serving them. While the plugin writes deny-all rules to upload directories to prevent unauthorized access, this protection depends on the web server honoring these rules. Apache servers enforce the restriction, limiting unauthorized access, but servers like nginx that ignore these rules do not gain additional exposure from the vulnerable endpoint since files are already accessible via direct URLs.

Unauthenticated users who know the stored filename of a customer-uploaded file can retrieve it without authorization on affected versions of the plugin. The risk is mitigated on Apache servers due to deny-all rules but remains on servers that do not enforce these rules. There is no indication of active exploitation in the wild. The impact is unauthorized disclosure of potentially sensitive customer-uploaded files.

No official fix or patch is currently available. Users should verify their web server configuration to ensure that deny-all rules in upload directories are enforced (e.g., using Apache). On servers that do not honor these rules, additional access controls or temporary mitigations should be considered to restrict access to uploaded files. Monitor the vendor advisory for updates and apply official patches once released.