Extra Checkout Options Addon For Extra Product Options Plugin
Monthly
Remote code execution in the Extra Checkout Options addon (for Extra Product Options & Add-Ons for WooCommerce) affects all WordPress installs running versions through 2.3.2, letting authenticated Subscriber-level attackers upload PHP web shells. Two flaws chain together: eco_save_settings() lacks authorization and nonce checks so a low-privileged user can add 'php' to the tc_eco_custom_file_types upload allowlist, and the wc_eco_upload_file AJAX action performs insufficient authorization, permitting file upload via the frontend nonce exposed on cart and checkout pages. There is no public exploit identified at time of analysis, but the CVSS 8.8 rating and the fact that only Subscriber access is required make this a serious risk; note the vendor only partially fixed it in 2.3.2.
Remote code execution in the Extra Checkout Options addon (for Extra Product Options & Add-Ons for WooCommerce) affects all WordPress installs running versions through 2.3.2, letting authenticated Subscriber-level attackers upload PHP web shells. Two flaws chain together: eco_save_settings() lacks authorization and nonce checks so a low-privileged user can add 'php' to the tc_eco_custom_file_types upload allowlist, and the wc_eco_upload_file AJAX action performs insufficient authorization, permitting file upload via the frontend nonce exposed on cart and checkout pages. There is no public exploit identified at time of analysis, but the CVSS 8.8 rating and the fact that only Subscriber access is required make this a serious risk; note the vendor only partially fixed it in 2.3.2.