Description
The Advanced Product Fields (Product Addons) for WooCommerce WordPress plugin from 1.6.22 to 1.7.3 does not validate that a submitted value for a required paid product option matches one of the configured choices, only that it is not empty, allowing unauthenticated users to add a product to the cart and complete an order while skipping the required option's surcharge and paying only the base product price.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Advanced Product Fields (Product Addons) for WooCommerce | 1.6.22 – < 1.7.4 | 1.7.4 |
References
- https://wpscan.com/vulnerability/e02cc0f2-9f10-4114-b9b5-1e1a2ae18355/ exploit vdb-entry technical-description