CVE-2024-13359 is a high severity (CVSS 8.1) arbitrary file upload in the Product Input Fields for WooCommerce plugin, in versions up to and including 1.12.0. The record says version 1.12.1 is fully patched. Update to 1.12.1 or later and check the accepted extensions setting.
What's affected
- Product Input Fields for WooCommerce, all versions up to and including 1.12.0.
- By default it is vulnerable to a double extension upload. If the accepted file extensions field is blank, .php uploads may be possible.
The record states that 1.12.1 is fully patched. It adds that 1.12.2 was briefly and mistakenly marked as patched while 1.12.1 was marked vulnerable, and that this was an error.
How to check if you're exposed
Run the command below from the WordPress root with WP-CLI, or check the Plugins or Themes screen in the dashboard. Check staging, development and multisite networks too.
wp plugin list --format=table | grep -i input-fields
Compare the version shown to the affected range above. If you manage many sites, run the same check on each one.
What to do now
- Update to 1.12.1 or later.
- Open the plugin settings and make sure the accepted file extensions field is not blank.
- Check the uploads folder for unexpected script files, and block script execution there.
- Look up CVE-2024-13359 on its Gold page to see the current details and any fix information.
- Scan your sites again after changes. Our free in-browser dependency scan covers package manifests such as package.json and requirements.txt, so use it for the build tooling around your site as well.
Why it matters
The cause is insufficient file type validation in add_product_input_fields_to_order_item_meta(). Attack complexity is high because the exploit depends on server behavior with double extensions, or on an administrator leaving the accepted extensions field empty.
The record's own note on version labeling is a useful reminder. Advisory databases sometimes mislabel fixed versions, so confirm the version against the vendor's changelog when it matters.
This CVE is an arbitrary file upload flaw (CWE-434, Unrestricted File Upload). Nothing in the record says it is exploited in the wild, and it is not marked as listed in CISA's Known Exploited Vulnerabilities catalog. That is a snapshot, so keep checking.
File upload handlers are risky because the server ends up storing something a stranger chose. If the handler does not check the file type properly, a file that the web server treats as code can end up in a web-reachable folder, and code that runs on your server is the start of a full compromise.
The usual defenses are an allowlist of file types checked on the server, renaming uploads, storing them outside the web root or with script execution turned off, and requiring authentication where possible. Double extension tricks work only on some server configurations, which is why the advisory language is conditional. The attack complexity is rated high for that reason.
Quick check
Which version is fixed?
1.12.1, per the record.
What setting reduces risk?
Keep the accepted file extensions field filled in. A blank field may allow .php uploads.
Sources
Note: these pages could not be retrieved when this post was written, so statements rest on the CVE record text. Check the vendor pages for the latest version information.
Last reviewed: 19 October 2026.
