CVE-2025-13924
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
The Advanced Product Fields (Product Addons) for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.6.17. This is due to missing or incorrect nonce validation on the 'maybe_duplicate' function. This makes it possible for unauthenticated attackers to duplicate and publish product field groups, including draft and pending field groups, via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Risk Assessment
It may lead to unauthorized duplication and publishing of product field groups, compromising data integrity.
Recommendation
Update the Advanced Product Fields plugin to a version later than 1.6.17 to fix the nonce validation.
Other vulnerabilities in Advanced Product Fields (Product Addons) for WooCommerce
Original NVD description (English source)
The Advanced Product Fields (Product Addons) for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.6.17. This is due to missing or incorrect nonce validation on the 'maybe_duplicate' function. This makes it possible for unauthenticated attackers to duplicate and publish product field groups, including draft and pending field groups, via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS