CVE-2020-36731

Name of the Vulnerable Software and Affected Versions Flexible Checkout Fields for WooCommerce plugin for WordPress versions up to and including 2.3.1

Description The issue is caused by missing authorization checks on the updateSettingsAction() function, which is called via an admin init hook, and missing sanitization and escaping on stored settings. This leads to Unauthenticated Arbitrary Plugin Settings update and Stored Cross-Site Scripting.

Recommendations For versions up to and including 2.3.1, update to a version that includes the necessary authorization checks and sanitization to prevent Unauthenticated Arbitrary Plugin Settings update and Stored Cross-Site Scripting. As a temporary workaround, consider disabling the updateSettingsAction() function until a patch is available.