¿Es seguro Flexible Checkout Fields?

Qué hace este plugin

• Slug: flexible-checkout-fields
• 80000+ instalaciones activas

checkout field customizercustom fieldsWooCommerce checkoutwoocommerce checkout fieldsWooCommerce checkout manager

Estado de mantenimiento

• Última versión conocida: 4.1.39
• Requiere PHP: 7.4+
• PHP máximo soportado (analizado): 8.4

Vulnerabilidades conocidas

2 CVEs conocidos registrados para Flexible Checkout Fields. Reportadas entre 2020 y 2024.

CVE-2024-31267

Update the WordPress Flexible Checkout Fields for WooCommerce plugin to the latest available version (at least 4.1.3). Dhabaleshwar Das discovered and reported this Broken Access Control vulnerability in WordPress Flexible Checkout Fields for WooCommerce Plugin. A broken access control issue refers to a missing authorization, authentication or nonce token check in a function that could lead to an unprivileged user to executing a certain higher privileged action. This vulnerability has been fixed in version 4.1.3. This vulnerability was reported to and published by Patchstack. Our users receive alerts and protections up to 48 hours in advance. Have additional information or questions about this entry? Get in touch.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

CVE-2020-36731

The Flexible Checkout Fields for WooCommerce plugin for WordPress is vulnerable to Unauthenticated Arbitrary Plugin Settings update, in addition to Stored Cross-Site Scripting in versions up to, and including, 2.3.1. This is due to missing authorization checks on the updateSettingsAction() function which is called via an admin_init hook, along with missing sanitization and escaping on the settings that are stored.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

Flexible Checkout Fields for WooCommerce – WooCommerce Checkout Manager [flexible-checkout-fields] < 2.3.2

Security Bypass vulnerability discovered by NinTechNet in WordPress Flexible Checkout Fields for WooCommerce plugin (versions <= 2.3.1).

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

Flexible Checkout Fields for WooCommerce – WooCommerce Checkout Manager [flexible-checkout-fields] < 2.3.2

The Flexible Checkout Fields for WooCommerce plugin for WordPress is vulnerable to Unauthenticated Arbitrary Plugin Settings update, in addition to Stored Cross-Site Scripting in versions up to, and including, 2.3.1. This is due to missing authorization checks on the updateSettingsAction() function which is called via an admin_init hook, along with missing sanitization and escaping on the settings that are stored.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

Flexible Checkout Fields for WooCommerce – WooCommerce Checkout Manager [flexible-checkout-fields] < 2.3.2

According to various sources, the plugin was being actively exploited in the wild, injecting scripts into the WooCommerce checkout pages.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: WPScan

Cómo solucionarlo

Mantén Flexible Checkout Fields actualizado — 4.1.39 es la última versión en wordpress.org, y cada CVE de arriba indica la versión exacta que lo corrigió ("Corregido en").

Este es el historial completo de vulnerabilidades conocidas del plugin, no un escaneo de una instalación específica — ejecuta un escaneo gratis de tu propio sitio para verificar tu versión instalada exacta.

Alternativas más seguras / más establecidas

• Advanced Custom Fields (ACF®) — 2000000+ instalaciones activas — 90/100 (1437) — PHP máx. 8.4
• Meta Box — 500000+ instalaciones activas — 96/100 (164) — PHP máx. 8.4
• Checkout Field Editor (Checkout Manager) for WooCommerce — 400000+ instalaciones activas — 98/100 (1055) — PHP máx. 8.4
• Admin Columns — 100000+ instalaciones activas — 98/100 (1650)
• Pods – Custom Content Types and Fields — 100000+ instalaciones activas — 96/100 (418) — PHP máx. 8.4