Unauthenticated Arbitrary Plugin Settings Update in Flexible Checkout Fields for WooCommerce

CVE-2020-36731

What is CVE-2020-36731?

The Flexible Checkout Fields for WooCommerce plugin is exposed to significant security risks due to the lack of necessary authorization checks. Specifically, vulnerability arises in the updateSettingsAction() function triggered via the admin_init hook, allowing unauthorized users to modify plugin settings. Additionally, missing sanitization and escaping processes for stored settings can lead to Stored Cross-Site Scripting attacks. These issues make installations of the plugin vulnerable to misuse and data compromise.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References