Product Input Fields for WooCommerce Unauthenticated File Download Scanner

Product Input Fields for WooCommerce is a plugin used by business owners running WordPress sites with WooCommerce to gather custom product information from buyers. This software is widely utilized in e-commerce platforms to enhance the customization of products and services. Online retailers employ this tool to offer a personalized shopping experience by allowing customers to input specific data related to the products they wish to purchase. Businesses across various sectors find it useful in handling complex orders that require detailed buyer specifications. This plugin is instrumental in improving customer satisfaction by accommodating unique product requests.

The Unauthenticated File Download vulnerability occurs when unauthorized users can access and download files without proper permissions, posing significant security threats. This vulnerability in the specified product can expose sensitive information to malicious actors. The flaw particularly affects functions that should have strict access control but fail to enforce it adequately. Attackers can exploit this by crafting requests that bypass authentication checks, leading to unauthorized file retrieval.

Specifically, the vulnerability resides in the file download endpoint handled by the plugin's AJAX actions. The vulnerable function does not verify user authentication or nonce validation before processing file download requests. This allows any unauthenticated user to send a request with a file path parameter and download files from the server, including sensitive configuration files or user data.

If exploited, an attacker can download arbitrary files from the WordPress installation, such as wp-config.php, database backups, or uploaded user files. This can lead to full site compromise, data breaches, and exposure of sensitive business information. The high CVSS score of 8.6 reflects the severe impact on confidentiality and the ease of exploitation without any privileges.