Remote Code Execution Vulnerability in WooCommerce Products Filter Plugin by WordPress

CVE-2018-8710

Summary

The WooCommerce Products Filter plugin for WordPress contains a vulnerability that allows remote code execution. This issue arises from the plugin's AJAX function, which can be accessed without authentication. Specifically, the vulnerability is triggered by the 'shortcode' parameter in the 'woof_redraw_woof' action. Malicious users can exploit this flaw to execute potentially harmful WordPress shortcode markup, which is usually restricted to authenticated users. This presents a significant security risk, as it enables unauthorized users to execute commands that could compromise the integrity of the website.

References