Flexible Checkout Fields Vulnerabilities

The Flexible Checkout Fields for WooCommerce plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 4.1.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform an unauthorized action.

CVSS:

4.3

Affected:

up to 4.1.2

Fixed in:

4.1.3

Disclosed:

Apr 5, 2024

CVE-2024-31267 on NVD →

The Flexible Checkout Fields for WooCommerce plugin for WordPress is vulnerable to Unauthenticated Arbitrary Plugin Settings update, in addition to Stored Cross-Site Scripting in versions up to, and including, 2.3.1. This is due to missing authorization checks on the updateSettingsAction() function which is called via...

CVSS:

7.2

Affected:

up to 2.3.2

Fixed in:

2.3.2

Disclosed:

Feb 26, 2020

CVE-2020-36731 on NVD →