Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2026-81789

CVE-2026-81789HIGH

Studio Wombat Advanced Product Fields Extended for WooCommerce — WordPress Advanced Product Fields Extended for WooCommerce plugin <= 3.1.6 - Arbitrary File Deletion vulnerability

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  C  N  N  H    8.6   .0053   43.0     —

AFFECTED
  Product                                           Versions  Fixed
  Advanced Product Fields Extended for WooCommerce  n/a –     3.1.7

TIMELINE
  Aug 27  Reserved by Patchstack
  Sep 10  Published (CNA: Patchstack)
  Sep 11  PATCH SHIPPED — CVE-2026-81789 (Studio Wombat Advanced Product Fields Extended for WooCommerce). Fixed in Advanced Product Fields Extended for WooCommerce 3.1.7.

CWE-22 · CNA: Patchstack · CVSS v3.1 · 1 reference · NVD status: Deferred

Description

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Studio Wombat Advanced Product Fields Extended for WooCommerce allows Path Traversal. This issue affects Advanced Product Fields Extended for WooCommerce: from n/a through 3.1.6.

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
August 27, 2026	Reserved	Reserved by Patchstack
September 10, 2026	Published	Published (CNA: Patchstack)
September 11, 2026	PATCH SHIPPED	PATCH SHIPPED — CVE-2026-81789 (Studio Wombat Advanced Product Fields Extended for WooCommerce). Fixed in Advanced Product Fields Extended for WooCommerce 3.1.7.

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
Studio Wombat	Advanced Product Fields Extended for WooCommerce	—	n/a	3.1.7

Weaknesses

CWE-22

References (1)

https://patchstack.com/database/wordpress/plugin/advanced-product-fields-for-woocommerce-extended/vulnerability/wordpress-advanced-product-fields-extended-for-woocommerce-plugin-3-1-6-arbitrary-file-deletion-vulnerability?_s_id=cve

Authoritative record: CVE-2026-81789 at cve.org

Vendors: studio wombat

Weaknesses: CWE-22

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-81789 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Sunday, October 4, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.