Description

WordPress Plugin Product Addons & Fields for WooCommerce is prone to same origin method execution (SOME) vulnerability. The impact of a SOME attack is similar to the impact of cross-site scripting, though there are some important and distinguishing exploitation restrictions. An attacker may leverage this issue to hijack dangerous web functionality and even exfiltrate sensitive user data. WordPress Plugin Product Addons & Fields for WooCommerce version 14.0 is vulnerable; prior versions may also be affected.

Remediation

Update to plugin version 14.1 or latest

References

https://web.archive.org/web/20180922183850/https://wordpress.org/support/topic/sites-hacked-using-this-plugin/

https://gist.github.com/cure53/09a81530a44f6b8173f545accc9ed07e

https://www.pluginvulnerabilities.com/2018/09/25/wordpress-support-forum-moderators-engaged-in-cover-up-of-security-issues-in-wordpress-plugins/

https://plugins.svn.wordpress.org/woocommerce-product-addon/trunk/readme.txt

Related Vulnerabilities

WordPress Plugin BuddyPress Multiple Vulnerabilities (5.1.2)

MySQL CVE-2016-0650 Vulnerability (CVE-2016-0650)

MySQL CVE-2012-1702 Vulnerability (CVE-2012-1702)

Jenkins Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') Vulnerability (CVE-2018-1000193)

Moodle Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2012-0796)

Severity

High

Classification

CVE-2016-4566 CWE-79 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Tags

Missing Update XSS