CVE-2024-7257

Published
View on NVD ↗
CVSS v3
9.8
CRITICAL
CVSS v2
N/A
Affected
1
PROJECT

Description

The YayExtra – WooCommerce Extra Product Options plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the handle_upload_file function in all versions up to, and including, 1.3.7. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.

<p>YayExtra – Product Options for WooCommerce lets you add customizable options and extra fields to your products.</p> <p>Perfect for stores that sell personalized, configurable, or add-on products.</p> <p><strong>What you can do with YayExtra:</strong></p> <ul> <li><strong>Add custom product options</strong> to any WooCommerce product</li> <li>Offer <strong>personalization fields</strong> (name, message, notes, etc.)</li> <li>Create product add-ons from <strong>existing products</strong></li> <li><strong>Collect extra information</strong> from customers before checkout</li> <li>Improve product pages and increase order value</li> </ul> <p>👉 Check it out: <a href="https://yaycommerce.com/yayextra-woocommerce-extra-product-options/" rel="nofollow ugc"><strong>YayExtra &#8211; Woo Product Options Pro</strong></a> 👀</p> <p><strong>Works great for selling:</strong></p> <ul> <li>Custom apparel</li> <li>Personalized gifts</li> <li>Configurable products</li> <li>Service add-ons</li> <li>Print-on-demand items</li> <li>Value-added services</li> </ul> <p>Build better product pages. Offer more choices. Sell more with YayExtra.</p> <p>📌 <a href="https://demo.yaycommerce.com/yayextra/product/t-shirt/" rel="nofollow ugc">Quick Demo</a> | <a href="https://demo.yaycommerce.com/try-yayextra" rel="nofollow ugc">Admin Test Drive</a></p> <span class="embed-youtube" style="text-align:center; display: block;"><iframe loading="lazy" class="youtube-player" width="750" height="422" src="https://www.youtube.com/embed/qytEac2_Yr0?version=3&#038;rel=1&#038;showsearch=0&#038;showinfo=1&#038;iv_load_policy=1&#038;fs=1&#038;hl=en-US&#038;autohide=2&#038;wmode=transparent" allowfullscreen="true" style="border:0;" sandbox="allow-scripts allow-same-origin allow-popups allow-presentation allow-popups-to-escape-sandbox"></iframe></span> <p>Why Upgrade? Check it here: <a href="https://docs.yaycommerce.com/yayextra/why-upgrade" rel="nofollow ugc">Free vs Pro</a></p> <h3>⚡️ FEATURES</h3> <p><strong>Powerful Custom Product Options</strong><br /> YayExtra supports many <a href="https://docs.yaycommerce.com/yayextra/how-it-works/option-types" rel="nofollow ugc">WooCommerce product field types</a> to serve your diverse use cases:</p> <ul> <li>Allow customers to input text, number, email, etc.</li> <li>Add radio buttons to the original product</li> <li>Enable checkbox to allow for privacy policy acknowledgement</li> <li>Add button rows to customize the base product</li> <li>Add one time fee in percentage or fixed amount</li> <li>Add multiple fees to multiple product options</li> <li>Display the subtotal for the selected extras</li> </ul> <p><strong>Multiple Options in an Option Set</strong><br /> You can add many product custom fields in the same group. Related options can be displayed next to each other or vertically. A product field can trigger the display of the next product field.</p> <p><strong>Apply Product Options in Bulk</strong><br /> A group of product fields can be applied to all products, a group of products in a specific category, a group of products with a specific tag, or hand-picked products.</p> <p><strong>Developer-Friendly</strong><br /> This product options plugin allows using hooks for <code>before_calculate_totals</code> function to modify the <a href="https://docs.yaycommerce.com/yayextra/developer-zone" rel="nofollow ugc">cart item line total</a>.</p> <p><strong>WooCommerce Conditional Variations</strong><br /> YayExtra allows you to create conditional logic that can be combined with the existing custom options. Conditional logic shows the next product fields if the user selects a specific option value.</p> <p>Let&#8217;s suppose that you sell car parts, so when the customer chooses to have &#8220;Accessories&#8221; then related options like &#8220;Front door items&#8221; or &#8220;Replacement kit&#8221; can be shown on the current product page. Otherwise, if the customer doesn&#8217;t check the &#8220;Accessories&#8221; checkbox, then those options will not show up, which will keep your product page neat and clear.</p> <p>💡 <strong>Want to sell more with every order?</strong> Meet <a href="https://yaycommerce.com/yayboost-sales-booster-for-woocommerce/" rel="nofollow ugc">YayBoost &#8211; Sales Booster for WooCommerce</a> 🎉<br /> It adds powerful upsell and cross-sell features to your WooCommerce store: free shipping nudge, product recommendations, order bumps, and post-purchase offers that convert. <a href="https://wordpress.org/plugins/yayboost-sales-booster-for-woocommerce/" rel="ugc">Try free version here <span aria-hidden="true" class="wp-exclude-emoji">↗</span></a></p> <h3>💎 PREMIUM-ONLY FEATURES</h3> <p><strong>Advanced Product Addons</strong><br /> Multiple field types are built in the premium version:</p> <ul> <li>Image swatches</li> <li>Button (multi selectable)</li> <li>Swatches (multi selectable)</li> <li>Date picker</li> <li>Time picker</li> <li>File Upload</li> </ul> <p><strong>Grouping and Bundling Products</strong><br /> Similar to &#8220;related products,&#8221; you can easily use an existing product as a swatch or option for another product.</p> <ul> <li>Assign the &#8220;Custom Stickers&#8221; product as an additional option for a range of &#8220;Bag&#8221; products.</li> <li>Offer a &#8220;Matched Cap&#8221; as an optional add-on for a &#8220;Baseball T-Shirt&#8221; to create a coordinated set.</li> <li>Quickly <a href="https://yaycommerce.com/best-ways-to-create-product-bundles/" rel="nofollow ugc">set up product bundles</a> and upsell opportunities to maximize sales.</li> </ul> <h3>🔑 ENHANCED SETTINGS</h3> <p>Each field type comes with various elements to help you enhance the extra product options:</p> <ul> <li>Required field: Require the customer to select an option or enter the information so it can be passed through in the order (Free)</li> <li>Placeholder: Add help text or expected value to be entered in the field (Free)</li> <li>Set as default: Enable a specific option value to be selected upon product page load (Free)</li> <li>Custom image: Use uploaded swatch image to show on product featured image (Premium-only)</li> <li>File upload: Add a single or multiple file uploads, make file uploads mandatory or optional, and many other options.</li> <li>File upload: Allow specific file formats like PNG, JPG, PDF, DOC, XLS, etc.</li> </ul>
WordPress Plugin DirectoryWordPress Plugin Directory
38.3K