Description

WordPress Plugin Product Addons & Fields for WooCommerce is prone to same origin method execution (SOME) vulnerability. The impact of a SOME attack is similar to the impact of cross-site scripting, though there are some important and distinguishing exploitation restrictions. An attacker may leverage this issue to hijack dangerous web functionality and even exfiltrate sensitive user data. WordPress Plugin Product Addons & Fields for WooCommerce version 14.0 is vulnerable; prior versions may also be affected.

Remediation

Update to plugin version 14.1 or latest

References

https://web.archive.org/web/20180922183850/https://wordpress.org/support/topic/sites-hacked-using-this-plugin/

https://gist.github.com/cure53/09a81530a44f6b8173f545accc9ed07e

https://www.pluginvulnerabilities.com/2018/09/25/wordpress-support-forum-moderators-engaged-in-cover-up-of-security-issues-in-wordpress-plugins/

https://plugins.svn.wordpress.org/woocommerce-product-addon/trunk/readme.txt

Related Vulnerabilities

Apache HTTP Server NULL Pointer Dereference Vulnerability (CVE-2020-13950)

Magento Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2019-7873)

Dolphin Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2014-4333)

WordPress Plugin Form Maker by 10Web-Mobile-Friendly Drag & Drop Contact Form Builder Cross-Site Scripting (1.13.59)

Internet Information Services Other Vulnerability (CVE-2001-0337)

Severity

High

Classification

CVE-2016-4566 CWE-79 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Tags

Missing Update XSS