Description
WordPress Plugin WooCommerce Blocks is prone to a security bypass vulnerability. Exploiting this issue may allow attackers to perform otherwise restricted actions and subsequently create accounts via checkout block request. WordPress Plugin WooCommerce Blocks version 3.7.0 is vulnerable; prior versions may also be affected.
Remediation
Update to plugin version 3.7.1 or latest
References
https://developer.woocommerce.com/2020/11/05/developer-advisory-spam-orders-and-accounts-from-bots/
https://plugins.svn.wordpress.org/woo-gutenberg-products-block/trunk/readme.txt
Related Vulnerabilities
Internet Information Services Other Vulnerability (CVE-2002-0149)
Envoy Proxy Allocation of Resources Without Limits or Throttling Vulnerability (CVE-2023-27492)
WordPress Plugin Funky Penguin WP-PHPList 'unsubscribeemail' Parameter Cross-Site Scripting (2.10.2)
WordPress Plugin Stripe Payment for WooCommerce Cross-Site Scripting (3.5.9)