Checkout Custom Fields Builder For Woocommerce
Monthly
Remote code execution via subscriber-level authorization bypass in the Checkout Custom Fields Builder for WooCommerce WordPress plugin (all versions ≤1.1.5) allows any authenticated subscriber to install an arbitrary attacker-hosted PHP plugin and achieve full server compromise. The plugin registers AJAX endpoints for plugin installation and activation without enforcing WordPress capability checks, and the required nonce is emitted directly into all admin pages visible to subscribers when WooCommerce is inactive - making the exploit trivially accessible to any registered user. No public exploit code has been identified, but the low authentication barrier and clear exploit path represent a critical risk on multi-user WordPress sites.
Remote code execution via subscriber-level authorization bypass in the Checkout Custom Fields Builder for WooCommerce WordPress plugin (all versions ≤1.1.5) allows any authenticated subscriber to install an arbitrary attacker-hosted PHP plugin and achieve full server compromise. The plugin registers AJAX endpoints for plugin installation and activation without enforcing WordPress capability checks, and the required nonce is emitted directly into all admin pages visible to subscribers when WooCommerce is inactive - making the exploit trivially accessible to any registered user. No public exploit code has been identified, but the low authentication barrier and clear exploit path represent a critical risk on multi-user WordPress sites.