Unauthenticated Arbitrary Plugin Settings Update in Flexible Checkout Fields for WooCommerce
CVE-2020-36731
7.2HIGH
Key Information:
- Vendor
Wordpress
- Vendor
- CVE Published:
- 7 June 2023
What is CVE-2020-36731?
The Flexible Checkout Fields for WooCommerce plugin is exposed to significant security risks due to the lack of necessary authorization checks. Specifically, vulnerability arises in the updateSettingsAction() function triggered via the admin_init hook, allowing unauthorized users to modify plugin settings. Additionally, missing sanitization and escaping processes for stored settings can lead to Stored Cross-Site Scripting attacks. These issues make installations of the plugin vulnerable to misuse and data compromise.
Affected Version(s)
Flexible Checkout Fields for WooCommerce – WooCommerce Checkout Manager * < 2.3.2