PT-2025-10411 · WordPress · Product Input Fields For Woocommerce

Lucky_Buddy · Published 2025-03-08 · Updated 2025-03-13 · CVE-2024-13359

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Product Input Fields for WooCommerce plugin for WordPress versions up to, and including, 1.12.1

Description The Product Input Fields for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the add product input fields to order item meta() function. This may make it possible for unauthenticated attackers to upload arbitrary files on the affected site's server, which may make remote code execution possible. By default, the plugin is only vulnerable to a double extension file upload attack, unless an administrator leaves the accepted file extensions field blank, which can make .php file uploads possible.

Recommendations For versions up to, and including, 1.12.1, consider disabling the add product input fields to order item meta() function until a patch is available. Restrict access to the plugin's file upload functionality to minimize the risk of exploitation. Avoid leaving the accepted file extensions field blank to prevent .php file uploads. Update to a version later than 1.12.1 when available.

Fix

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2024-13359

Affected Products

Product Input Fields For Woocommerce

References · 15

• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3250201%40product-input-fields-for-woocommerce&new=3250201%40product-input-fields-for-woocommerce&sfp_email=&sfph_mail= · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-13359 · Security Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3234567%40product-input-fields-for-woocommerce&new=3234567%40product-input-fields-for-woocommerce&sfp_email=&sfph_mail= · Patch
• https://osv.dev/vulnerability/CVE-2024-13359 · Vendor Advisory
• https://twitter.com/cracbot/status/1900139855331676576 · Twitter Post
• https://plugins.trac.wordpress.org/browser/product-input-fields-for-woocommerce/tags/-1.8.2/includes/class-alg-wc-pif-main.php · Note
• https://t.me/cvetracker/18740 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/a9c08f2e-bffd-40a6-89f3-559cb34f4395?source=cve · Note
• https://twitter.com/VulmonFeeds/status/1898357976475308326 · Twitter Post
• https://twitter.com/vuldb/status/1898501114863263857 · Twitter Post
• https://t.me/cvedetector/19898 · Telegram Post
• https://twitter.com/cybercronai/status/1898479228686860419 · Twitter Post
• https://twitter.com/CVEnew/status/1898310300656623919 · Twitter Post
• https://t.me/cvenotify/113986 · Telegram Post
• https://t.me/cvenotify/114585 · Telegram Post