Authorization Bypass in Product Input Fields for WooCommerce Plugin
CVE-2020-36696

7.5HIGH

Key Information:

Vendor
Wordpress
Status
Product Input Fields For WooCommerce
Vendor
CVE Published:
7 June 2023

Summary

The Product Input Fields for WooCommerce plugin for WordPress contains an authorization bypass vulnerability due to a missing capability check in the handle_downloads() function. Attackers with no authentication can exploit this flaw to download files from the affected service, potentially exposing sensitive data or resources.

Affected Version(s)

Product Input Fields for WooCommerce * <= 1.2.6

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://blog.nintechnet.com/high-severity-vulnerability-f...
https://wpscan.com/vulnerability/15f345e6-fc53-4bac-bc5a-...

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Jerome Bruandet
.