Loading vulnerability…
Unauthenticated Settings Modification and Stored XSS in Flexible Checkout Fields for WooCommerce
CVE-2020-36731 affects the Flexible Checkout Fields for WooCommerce WordPress plugin through version 2.3.1. Missing authorization checks in updateSettingsAction(), invoked through an admin_init hook, allow unauthenticated attackers to modify plugin settings. Missing sanitization and output escaping of stored settings additionally enable stored cross-site scripting. Reported exploitation involved injecting scripts into WooCommerce checkout pages. Version 2.3.2 fixes the vulnerability.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Unauthenticated attackers can modify arbitrary plugin settings and persist malicious scripts that execute in visitors' browsers when affected checkout pages render the injected content. Exploitation involving script injection into WooCommerce checkout pages was reported in the wild.
If you can’t patch tonight, do this now.
If patching is not immediately possible, disable or remove the Flexible Checkout Fields for WooCommerce plugin, or restrict access to the affected WordPress instance until an update can be applied. Monitor for unexpected changes to plugin settings and inspect stored configuration values for script payloads. Reduce exposure by limiting administrative access, enforcing strong session hygiene, and using compensating controls such as a web application firewall, though such measures may not fully prevent exploitation.
Patch, then assume compromise.
Upgrade Flexible Checkout Fields for WooCommerce to version 2.3.2 or later.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.