Checkout Field Editor Proに添付削除の脆弱性
Summary
WooCommerceのチェックアウト項目を編集するプラグインCheckout Field Editor Proに、ログインなしで添付ファイルを削除される脆弱性が見つかりました。利用中のサイトは更新の有無を確認し、メディアライブラリに欠けがないかも見てください。
AI summary
Produced by SecPulse using an external AI model; it may contain mistakes. Check the original description and references below before acting on it.
WooCommerceのチェックアウト項目を編集するプラグインCheckout Field Editor Proに、ログインなしで添付ファイルを削除される脆弱性が見つかりました。利用中のサイトは更新の有無を確認し、メディアライブラリに欠けがないかも見てください。
Affected packages
| Package | Affected → Fixed | |
|---|---|---|
| ThemehighCheckout Field Editor for WooCommerce (Pro) |
≤ 3.8.0→ Not listed |
Not listed |
This record does not list fixed versions. Check the article or the vendor advisory in the references for whether and where it is fixed.
Original description The description as published by the source.
The Checkout Field Editor for WooCommerce (Pro) plugin for WordPress is vulnerable to unauthorized deletion of arbitrary attachments due to a missing capability/ownership check in the ajax_remove_uploaded() function in versions up to, and including, 3.8.0. The handler is registered for both wp_ajax and wp_ajax_nopriv and is gated solely by the 'file_handling_nonce' nonce, which is emitted inside the public checkout page markup (data-nonce attribute) whenever a File Upload checkout field is configured. This makes it possible for unauthenticated attackers to delete arbitrary attachments (including those belonging to other users or posts) by submitting a crafted attachment_id, which can lead to loss of important media and potential denial of service.
Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory
References
- web wordfence.com
- web security@wordfence.com
- web nvd.nist.gov
- web themehigh.com
- web github.com