What’s Vulnerable › Vulnerabilities

CVE-2020-36696: Product Input Fields for WooCommerce <= 1.2.6 - Missing Authorization

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.1% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-06-07 · updated 2026-06-17
• Weakness: CWE-285

Description

The Product Input Fields for WooCommerce plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the handle_downloads() function in versions up to, and including, 1.2.6. This makes it possible for unauthenticated attackers to download files from the vulnerable service.

Affected products

• tychesoftwares Product Input Fields for WooCommerce: before 1.2.7 — fixed in 1.2.7

How to fix

Upgrade to a fixed version: tychesoftwares Product Input Fields for WooCommerce 1.2.7. Check the vendor advisory for mitigations.

References

• https://blog.nintechnet.com/high-severity-vulnerability-fixed-in-product-input-fields-for-woocommerce/
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2349889%40product-input-fields-for-woocommerce&new=2349889%40product-input-fields-for-woocommerce&sfp_email=&sfph_mail=
• https://wpscan.com/vulnerability/15f345e6-fc53-4bac-bc5a-de898181ea74
• https://www.wordfence.com/threat-intel/vulnerabilities/id/01e41573-9329-48e1-9191-e8e1532f7afc?source=cve
• https://blog.nintechnet.com/high-severity-vulnerability-fixed-in-product-input-fields-for-woocommerce/
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2349889%40product-input-fields-for-woocommerce&new=2349889%40product-input-fields-for-woocommerce&sfp_email=&sfph_mail=
• https://wpscan.com/vulnerability/15f345e6-fc53-4bac-bc5a-de898181ea74
• https://www.wordfence.com/threat-intel/vulnerabilities/id/01e41573-9329-48e1-9191-e8e1532f7afc?source=cve

Get alerted when CVE-2020-36696 or the next vulnerability affects your stack