Wombat Plugins vulnerabilities and threats

A high-severity vulnerability (CVE-2026-39499) exists in Wombat Plugins' Advanced Product Fields (Product Addons) for WooCommerce versions up to 1.6.19. It involves PHP Object Injection due to deserialization of untrusted data, which can lead to full confidentiality, integrity, and availability compromise. The vulnerability requires high privileges and no user interaction but can be exploited remotely over the network.

Missing Authorization vulnerability in Wombat Plugins Advanced Product Fields (Product Addons) for WooCommerce advanced-product-fields-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced Product Fields (Product Addons) for WooCommerce: from n/a through <= 1.6.18.

Server-Side Request Forgery (SSRF) vulnerability in Wombat Plugins WP Optin Wheel wp-optin-wheel allows Server Side Request Forgery.This issue affects WP Optin Wheel: from n/a through <= 1.4.7.