Responsive Plus – Elementor Templates & Starter Sites < 3.4.3 - Unauthenticated Arbitrary Code Execution

// includes/customizer/helper.php line 702
function update_responsive_woo_free_shipping_left_shortcode() {
	$atts = array();
	// The nonce is not provided by WooCommerce for this context, suppressing warning.
	// phpcs:disable WordPress.Security.NonceVerification.Missing

	if ( ( isset( $_POST['content'] ) && '' !== sanitize_text_field( wp_unslash( $_POST['content'] ) ) )
		|| ( isset( $_POST['content_rech_data'] ) && '' !== sanitize_text_field( wp_unslash( $_POST['content_rech_data'] ) ) ) ) {

		$atts['content_reached'] = sanitize_text_field( wp_unslash( $_POST['content_rech_data'] ) );
		$content                 = str_replace( '+', '%', sanitize_text_field( wp_unslash( $_POST['content_rech_data'] ) ) );
		$atts['content']         = $content;
		$return_shortcode_value  = woo_free_shipping_shortcode( $atts, '' );
		wp_send_json( $return_shortcode_value );

	} else {
		$return_shortcode_value = woo_free_shipping_shortcode( $atts, '' );
		wp_send_json( $return_shortcode_value );
	}
	// phpcs:enable
}

---

// includes/importers/batch-processing/class-responsive-ready-sites-batch-processing-elementor.php line 158
public function responsive_import_post_meta( $post_id = 0, $data = array() ) {

	if ( ! empty( $post_id ) && ! empty( $data ) ) {

		$data = wp_json_encode( $data, true );
		// ... mapping logic ...
		$data = json_decode( $data, true );

		// Import the data.
		$data = $this->process_export_import_content( $data, 'on_import' );

		// Update processed meta.
		update_metadata( 'post', $post_id, '_elementor_data', $data );
		// ...
	}
}

--- /includes/customizer/helper.php
+++ /includes/customizer/helper.php
@@ -702,25 +702,25 @@
 	 */
 	function update_responsive_woo_free_shipping_left_shortcode() {
 		$atts = array();
-		// The nonce is not provided by WooCommerce for this context, suppressing warning.
-		// phpcs:disable WordPress.Security.NonceVerification.Missing
-
-		if ( ( isset( $_POST['content'] ) && '' !== sanitize_text_field( wp_unslash( $_POST['content'] ) ) )
-			|| ( isset( $_POST['content_rech_data'] ) && '' !== sanitize_text_field( wp_unslash( $_POST['content_rech_data'] ) ) ) ) {
-
-			$atts['content_reached'] = sanitize_text_field( wp_unslash( $_POST['content_rech_data'] ) );
-			$content                 = str_replace( '+', '%', sanitize_text_field( wp_unslash( $_POST['content_rech_data'] ) ) );
-			$atts['content']         = $content;
-			$return_shortcode_value  = woo_free_shipping_shortcode( $atts, '' );
-			wp_send_json( $return_shortcode_value );
-
-		} else {
-
+		
+		// Don't accept POST data from users 
+		$default_bottom_text = esc_html__( '[responsive_woo_free_shipping_left]', 'responsive-addons-pro' );
+		$custom_text = get_theme_mod( 'responsive_popup_bottom_text', $default_bottom_text );
+		
+		// Parse shortcode attributes from the stored value
+		if ( ! empty( $custom_text ) && preg_match( '/\\[responsive_woo_free_shipping_left(.*?)\\]/', $custom_text, $matches ) ) {
+			// Extract attributes like content_reached="Custom message"
+			if ( ! empty( $matches[1] ) ) {
+				$shortcode_attrs = shortcode_parse_atts( $matches[1] );
+				if ( ! empty( $shortcode_attrs ) && is_array( $shortcode_attrs ) ) {
+					$atts = $shortcode_attrs;
+				}
+			}
+		}
+		
+		// Recalculate from cart state using trusted database values
 			$return_shortcode_value = woo_free_shipping_shortcode( $atts, '' );
 			wp_send_json( $return_shortcode_value );
-
-		}
-		// phpcs:enable
 	}