CVE-2020-36696: Product Input Fields for WooCommerce <= 1.2.6 - Missing Authorization
The Product Input Fields for WooCommerce plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the handledownloads() function in versions up to, and including, 1.2.6. This makes it possible for unauthenticated attackers to download files from the vulnerable service.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2020-36696.
What is the severity of CVE-2020-36696?
The severity of CVE-2020-36696 is high (7.5).
Which software versions are affected by CVE-2020-36696?
The Product Input Fields for WooCommerce plugin for WordPress versions up to and including 1.2.6 are affected by CVE-2020-36696.
How can unauthenticated attackers exploit CVE-2020-36696?
Unauthenticated attackers can exploit CVE-2020-36696 to bypass authorization and download files from the vulnerable WordPress plugin.
Are there any references available for CVE-2020-36696?
Yes, here are some references for CVE-2020-36696: [Link 1](https://blog.nintechnet.com/high-severity-vulnerability-fixed-in-product-input-fields-for-woocommerce/), [Link 2](https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2349889%40product-input-fields-for-woocommerce&new=2349889%40product-input-fields-for-woocommerce&sfp_email=&sfph_mail=), [Link 3](https://wpscan.com/vulnerability/15f345e6-fc53-4bac-bc5a-de898181ea74).