Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
Unknown Extra Product Options Builder for WooCommerce — Extra Product Options Builder for WooCommerce < 1.2.176 - Unauthenticated Customer File Disclosure via getpublicfileupload
AV AC PR UI S C I A CVSS EPSS %ile KEV
N L N N U H N N 7.5 .0044 37.1 —
AFFECTED
Product Versions Fixed
Extra Product Options Builder for WooCommerce unspecified —
TIMELINE
Aug 13 Reserved by WPScan
Aug 15 EXPLOIT PUBLISHED — CVE-2026-19728 (Unknown Extra Product Options Builder for WooCommerce). Public exploit reference added.
Aug 16 Published (CNA: WPScan)
Description
The Extra Product Options Builder for WooCommerce WordPress plugin before 1.2.176 does not verify that the requester is entitled to a customer-uploaded file before serving it, allowing unauthenticated users who obtain a file's stored name to retrieve it.
The Extra Product Options Builder for WooCommerce WordPress plugin before 1.2.176 writes a deny-all rule into its upload directories, so the disclosure only crosses a boundary on web servers that honour it, such as Apache. Where it is ignored, as on a default nginx setup, the same files are already served at their direct URL and the endpoint exposes nothing further.
Lifecycle
Complete event history — 3 events, chronological
| Date | Event | Detail |
|---|
| August 13, 2026 | Reserved | Reserved by WPScan |
| August 15, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-19728 (Unknown Extra Product Options Builder for WooCommerce). Public exploit reference added. |
| August 16, 2026 | Published | Published (CNA: WPScan) |
Affected
Affected products and packages — 1 row
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|
| Unknown | Extra Product Options Builder for WooCommerce | — | — | — |
About this page
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-19728 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.