Advanced Product Fields (Product Addons) pour WooCommerce <= 1.6.17 - Cross-Site Request Forgery permettant la duplication et la publication de groupes de champs de produits

Successful exploitation of CVE-2025-13924 allows an attacker to forge requests and duplicate product field groups within a WooCommerce store. This can lead to the creation of unauthorized product field configurations, potentially disrupting the product creation process or introducing unexpected behavior. An attacker could publish draft or pending field groups, potentially injecting malicious content or altering product behavior. While direct data theft isn't the primary impact, the ability to manipulate product configurations can have significant operational consequences for e-commerce businesses. The blast radius is limited to the affected WooCommerce store and its administrative users.

E-commerce businesses utilizing the Advanced Product Fields (Product Addons) for WooCommerce plugin are at risk. Specifically, sites with multiple administrators or those where administrators frequently click on links from untrusted sources are more vulnerable. Shared hosting environments where plugin updates are not consistently applied are also at increased risk.

• wordpress / composer / npm:

grep -r 'maybe_duplicate' /var/www/html/wp-content/plugins/advanced-product-fields-for-woocommerce/

• wordpress / composer / npm:

wp plugin list --status=active | grep 'Advanced Product Fields'

• wordpress / composer / npm:

wp plugin update advanced-product-fields-for-woocommerce

• wordpress / composer / npm:

wp plugin status advanced-product-fields-for-woocommerce

1. 2025-12-09Disclosure

   disclosure

Installations actives

50KConnu

Note du plugin

4.8

Nécessite WordPress

4.5+

Compatible jusqu'à

7.0

Nécessite PHP

7.0+

1. Réservé2025-12-02
2. Publiée2025-12-09
3. Modifiée2026-04-08
4. EPSS mis à jour2026-03-23

The primary mitigation for CVE-2025-13924 is to immediately upgrade the Advanced Product Fields (Product Addons) for WooCommerce plugin to version 1.6.18 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider implementing stricter input validation and output encoding practices within your custom WooCommerce development. While a direct WAF rule is difficult to implement, monitor for unusual product field duplication requests. After upgrading, confirm the fix by attempting to duplicate a product field group as an unauthenticated user – the action should be denied.