CVE-2026-39499 is a PHP Object Injection vulnerability classified under CWE-502 in the Advanced Product Fields (Product Addons) plugin for WooCommerce by Wombat Plugins. The flaw allows users with shop manager privileges to perform deserialization of untrusted data, potentially enabling remote code execution or other malicious actions. The vulnerability affects versions up to and including 1.6.19. The CVSS 3.1 base score is 7.2, indicating high severity with network attack vector, low attack complexity, high privileges required, no user interaction, and full impact on confidentiality, integrity, and availability. No official patch or remediation guidance has been published by the vendor as of the provided data.

Successful exploitation of this vulnerability could allow an attacker with shop manager privileges to execute arbitrary PHP code or manipulate application logic via deserialization of crafted data. This compromises the confidentiality, integrity, and availability of the affected WooCommerce installation and potentially the underlying server environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict shop manager privileges to trusted users only and monitor for suspicious activity related to plugin usage. Avoid importing or processing untrusted serialized data within the plugin environment.