CVE-2021-4337
Description
Sixteen XforWooCommerce Add-On Plugins for WordPress are vulnerable to authorization bypass due to a missing capability check on the wp_ajax_svx_ajax_factory function in various versions listed below. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to read, edit, or delete WordPress settings, plugin settings, and to arbitrarily list all users on a WordPress website. The plugins impacted are: Product Filter for WooCommerce < 8.2.0, Improved Product Options for WooCommerce < 5.3.0, Improved Sale Badges for WooCommerce < 4.4.0, Share, Print and PDF Products for WooCommerce < 2.8.0, Product Loops for WooCommerce < 1.7.0, XforWooCommerce < 1.7.0, Package Quantity Discount < 1.2.0, Price Commander for WooCommerce < 1.3.0, Comment and Review Spam Control for WooCommerce < 1.5.0, Add Product Tabs for WooCommerce < 1.5.0, Autopilot SEO for WooCommerce < 1.6.0, Floating Cart < 1.3.0, Live Search for WooCommerce < 2.1.0, Bulk Add to Cart for WooCommerce < 1.3.0, Live Product Editor for WooCommerce < 4.7.0, and Warranties and Returns for WooCommerce < 5.3.0.
How to fix
- xforwoocommerce autopilot_seo1.6.0 or later
- xforwoocommerce add_product_tabs1.5.0 or later
- xforwoocommerce bulk_add_to_cart1.3.0 or later
- xforwoocommerce comment_and_review_spam_control1.5.0 or later
- xforwoocommerce floating_cart1.3.0 or later
- xforwoocommerce improved_product_options5.3.0 or later
- xforwoocommerce improved_sale_badges4.4.0 or later
- xforwoocommerce live_product_editor4.7.0 or later
- xforwoocommerce live_search2.1.0 or later
- xforwoocommerce package_quantity1.2.0 or later
- xforwoocommerce price_commander1.3.0 or later
- xforwoocommerce product_filter8.2.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| xforwoocommerce autopilot_seo | v < 1.6.0 | 1.6.0 |
| xforwoocommerce add_product_tabs | v < 1.5.0 | 1.5.0 |
| xforwoocommerce bulk_add_to_cart | v < 1.3.0 | 1.3.0 |
| xforwoocommerce comment_and_review_spam_control | v < 1.5.0 | 1.5.0 |
| xforwoocommerce floating_cart | v < 1.3.0 | 1.3.0 |
| xforwoocommerce improved_product_options | v < 5.3.0 | 5.3.0 |
| xforwoocommerce improved_sale_badges | v < 4.4.0 | 4.4.0 |
| xforwoocommerce live_product_editor | v < 4.7.0 | 4.7.0 |
| xforwoocommerce live_search | v < 2.1.0 | 2.1.0 |
| xforwoocommerce package_quantity | v < 1.2.0 | 1.2.0 |
| xforwoocommerce price_commander | v < 1.3.0 | 1.3.0 |
| xforwoocommerce product_filter | v < 8.2.0 | 8.2.0 |
| xforwoocommerce product_loops | v < 1.7.0 | 1.7.0 |
| xforwoocommerce share\,_print_and_pdf_products | v < 2.8.0 | 2.8.0 |
| xforwoocommerce warranties_and_returns | v < 5.3.0 | 5.3.0 |
| xforwoocommerce xforwoocommerce | v < 1.7.0 | 1.7.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.