CVE-2018-8711: woocommerce-filter woocommerce_products_filter Improper Input Validation

Vulnerability summary

CVE-2018-8711 is a critical (CVSS 9.8) Improper Input Validation vulnerability in woocommerce-filter woocommerce_products_filter. EPSS estimates a 1.92% chance of exploitation in the next 30 days, higher than 79.6% of scored vulnerabilities.

Timeline

1. 14-03-2018
   PublishedVulnerability first disclosed.
2. 17-09-2024
   Last modifiedVulnerability information updated.

Description

A local file inclusion issue was discovered in the WooCommerce Products Filter (aka WOOF) plugin before 2.2.0 for WordPress, as demonstrated by the shortcode parameter in a woof_redraw_woof action. The vulnerability is due to the lack of args/input validation on render_html before allowing it to be called by extract(), a PHP built-in function. Because of this, the supplied args/input can be used to overwrite the $pagepath variable, which then could lead to a local file inclusion attack.

• CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
• CWE-98Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions.