Unauthenticated Arbitrary Plugin Settings Update in Flexible Checkout Fields for WooCommerce

CVE-2020-36731

Summary

The Flexible Checkout Fields for WooCommerce plugin is exposed to significant security risks due to the lack of necessary authorization checks. Specifically, vulnerability arises in the updateSettingsAction() function triggered via the admin_init hook, allowing unauthorized users to modify plugin settings. Additionally, missing sanitization and escaping processes for stored settings can lead to Stored Cross-Site Scripting attacks. These issues make installations of the plugin vulnerable to misuse and data compromise.

References