Published on November 19th, 2021 📆 | 7262 Views ⚑0
WordPress Preview E-mails For WooCommerce 1.6.8 Cross Site Scripting – Torchsec
Affected Plugin: Preview E-mails for WooCommerce
Plugin Slug: woo-preview-emails
Affected Versions: < = 1.6.8
CVE ID: CVE-2021-42363
CVSS Score: 6.1 (Medium)
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Researcher/s: Chloe Chamberland
Fully Patched Version: 2.0.0
Preview E-mails for WooCommerce is a simple plugin designed to give site owners the ability to preview the emails that are sent to customers via WooCommerce. Unfortunately, the plugin had a flaw that made it possible for attackers to inject malicious web scripts into the `digthis-woocommerce-preview-emails` page.
As part of the plugin’s functionality, there is a feature to search orders and to generate an email preview based upon a specific order, so that an administrator or shop manager can see exactly what a specific user sees for the emails that get sent out. Unfortunately, the search_orders parameter, used to conduct the search, was reflected to the page and had no input sanitization or escaping upon output which made it possible for users to supply arbitrary scripts that would execute in the browser when the page was accessed with the payload set in the search_orders parameter.
November 1, 2021 – Conclusion of the plugin analysis that led to the discovery of a Reflected Cross-Site Scripting Vulnerability in the Preview E-mails for WooCommerce plugin. We validate that the Wordfence Firewall provides complete protection. We initiate contact with the developer.
November 3, 2021 – The developer confirms the inbox for handling the discussion.
November 4, 2021 – We send over the full disclosure details.
October 8, 2021 – A fully patched version of the plugin is released as version 2.0.0.
In today’s post, we detailed a flaw in the Preview E-mails for WooCommerce plugin that made it possible for attackers to inject malicious web scripts into a page that would execute if an attacker successfully tricked a site administrator into performing an action. This flaw has been fully patched in version 2.0.0.
We recommend that WordPress users immediately verify that their site has been updated to the latest patched version available, which is version 2.0.1 at the time of this publication.