Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,007 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Plugin · product-configurator-for-woocommerce
Product Configurator for WooCommerce
4 known vulnerabilities on record. Add your version above to see which ones affect you.
Is Product Configurator for WooCommerce safe? The full page →
Oct 9, 2026Product Configurator for WooCommerce: Deserialization of Untrusted DataCVE-2026-105872 · affects up to 1.7.5 · reported by PatchstackHigh 7.2
Deserialization of Untrusted Data vulnerability in mklacroix Product Configurator for WooCommerce product-configurator-for-woocommerce allows Object Injection.This issue affects Product Configurator for WooCommerce: from n/a through 1.7.5.
Jul 1, 2026Product Configurator for WooCommerce: Does not perform any authorisation or post-status check before returning WooCommerce product data through a public AJAX actionCVE-2026-11568 · fixed in 1.7.3 · reported by WPScanHigh 7.5
The Product Configurator for WooCommerce WordPress plugin before 1.7.3 does not perform any authorisation or post-status check before returning WooCommerce product data through a public AJAX action, allowing unauthenticated users to retrieve the data (title, price, weight, stock status, and configurator option pricing/SKUs) of private and draft, non-public products by supplying the product ID. WordPress post-visibility controls are bypassed.
Aug 14, 2025Product Configurator for WooCommerce: Cross-Site Request Forgery (CSRF)CVE-2025-54674 · affects up to 1.4.4 · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in mklacroix Product Configurator for WooCommerce product-configurator-for-woocommerce allows Cross Site Request Forgery.This issue affects Product Configurator for WooCommerce: from n/a through <= 1.4.4.
Jun 27, 2022Product Configurator for WooCommerce: Suffers from an arbitrary file deletion vulnerability via an AJAX actionCVE-2022-1953 · fixed in 1.2.32 · reported by WPScanCritical 9.1
The Product Configurator for WooCommerce WordPress plugin before 1.2.32 suffers from an arbitrary file deletion vulnerability via an AJAX action, accessible to unauthenticated users, which accepts user input that is being used in a path and passed to unlink() without validation first
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.