The Product Addons for Woocommerce – Product Options with Custom Fields plugin (WordPress) contains a code injection vulnerability in all versions up to 3.1.0. The flaw arises from insufficient validation of the 'operator' field in conditional logic rules within the evalConditions() function, which forwards raw user input to PHP's eval() function. An attacker with Shop Manager-level access can inject and execute arbitrary PHP code on the server when saving addon form field rules, leading to full system compromise. This flaw maps to CWE-94.

All WordPress sites installing the Product Addons for Woocommerce – Product Options with Custom Fields plugin version 3.1.0 or earlier are affected. Users must verify the plugin version in the WordPress admin area; if the installed version is 3.1.0 or earlier, the site is vulnerable.

The CVSS score is 7.2, indicating high severity. EPSS is reported as <1%, suggesting that exploitation is currently unlikely, and the vulnerability is not listed in the CISA KEV catalog. The attack requires authenticated access within the shop administration, typically a Shop Manager or higher, but once achieved, it gives remote code execution capabilities. The low EPSS indicates that exploitation may be limited or hidden, yet the impact makes the vulnerability highly dangerous if discovered.