CVE-2026-1929 - Vulnerability Analysis

Overview

Advanced Woo Labels WordPress plugin <= 2.37 contains a remote code execution caused by unsafe use of call_user_func_array() with user-controlled callback in get_select_option_values AJAX handler, letting authenticated contributors execute arbitrary PHP functions and OS commands.

Severity & Score

Impact

Authenticated contributors can execute arbitrary PHP functions and OS commands, potentially leading to full server compromise.

Mitigation

Update to a version later than 2.37 or the latest available version.

References

• https://plugins.trac.wordpress.org/browser/advanced-woo-labels/tags/2.34/includes/admin/class-awl-admin-ajax.php#L136
• https://plugins.trac.wordpress.org/browser/advanced-woo-labels/tags/2.34/includes/admin/class-awl-admin-ajax.php#L146
• https://plugins.trac.wordpress.org/browser/advanced-woo-labels/tags/2.37/includes/admin/class-awl-admin-ajax.php#L136
• https://plugins.trac.wordpress.org/browser/advanced-woo-labels/trunk/includes/admin/class-awl-admin-ajax.php#L146
• https://www.wordfence.com/threat-intel/vulnerabilities/id/bbae9c33-becb-4c9d-917f-0d8fe8312d0c?source=cve

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Feb 25, 2026

🟠 CVE-2026-1929 - High (8.8) The Advanced Woo Labels plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.37. This is due to the use of `call_user_func_array()` with user-controlled callback and parameters in the `get_select_opti... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-1929/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner