CVE-2021-4337 Information

Description

Sixteen XforWooCommerce Add-On Plugins for WordPress are vulnerable to authorization bypass due to a missing capability check on the wp_ajax_svx_ajax_factory function in various versions listed below. This makes it possible for authenticated attackers with subscriber-level permissions and above to read edit or delete WordPress settings plugin settings and to arbitrarily list all users on a WordPress website. The plugins impacted are: Product Filter for WooCommerce < 8.2.0 Improved Product Options for WooCommerce < 5.3.0 Improved Sale Badges for WooCommerce < 4.4.0 Share Print and PDF Products for WooCommerce < 2.8.0 Product Loops for WooCommerce < 1.7.0 XforWooCommerce < 1.7.0 Package Quantity Discount < 1.2.0 Price Commander for WooCommerce < 1.3.0 Comment and Review Spam Control for WooCommerce < 1.5.0 Add Product Tabs for WooCommerce < 1.5.0 Autopilot SEO for WooCommerce < 1.6.0 Floating Cart < 1.3.0 Live Search for WooCommerce < 2.1.0 Bulk Add to Cart for WooCommerce < 1.3.0 Live Product Editor for WooCommerce < 4.7.0 and Warranties and Returns for WooCommerce < 5.3.0.

Reference

https://blog.nintechnet.com/16-woocommerce-product-add-ons-plugins-fixed-vulnerabilities/ https://www.wordfence.com/threat-intel/vulnerabilities/id/05481984-7c18-4ec7-8d7c-831809c3e86b?source=cve https://xforwoocommerce.com/blog/change-log/xforwoocommerce-1-7-0/