CVE-2024-31267: Flexible Checkout Fields Auth Bypass Flaw

CVE-2024-31267 Overview

CVE-2024-31267 is a Missing Authorization vulnerability [CWE-862] in the WP Desk Flexible Checkout Fields for WooCommerce plugin. The flaw affects all versions from initial release through 4.1.2. An authenticated attacker with low privileges can invoke plugin functionality without the authorization checks required for the operation. This condition enables broken access control against WooCommerce storefronts that rely on the plugin to customize checkout fields.

Critical Impact
Authenticated low-privilege users can access and manipulate plugin actions that should be restricted, resulting in high impact to confidentiality, integrity, and availability of the WordPress site.

Affected Products

WP Desk Flexible Checkout Fields for WooCommerce (free edition)
All versions from n/a through 4.1.2
WordPress sites running WooCommerce with this plugin installed

Discovery Timeline

2024-06-09 - CVE-2024-31267 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-31267

Vulnerability Analysis

The plugin exposes one or more actions that do not verify whether the calling user has the correct capability to invoke them. Because WordPress relies on plugins to enforce their own capability checks on custom AJAX handlers and admin-post endpoints, the missing check makes those handlers reachable by any authenticated user, including customer-level accounts created through WooCommerce registration.

The issue is classified under Missing Authorization [CWE-862]. The attack requires network access and low privileges, no user interaction, and can compromise confidentiality, integrity, and availability of the target site. The Patchstack advisory categorizes the vulnerability as broken access control against the plugin's administrative surface.

Root Cause

The root cause is the absence of a current_user_can() capability check, and likely a missing nonce verification, on plugin handlers that modify checkout field configuration. WordPress action hooks such as admin_post_* and wp_ajax_* are reachable by any logged-in user unless the callback explicitly enforces authorization. In vulnerable releases, one or more of these callbacks execute privileged logic without confirming the caller has the manage_woocommerce or manage_options capability.

Attack Vector

An attacker first registers or acquires a low-privilege WordPress account, which is trivial on stores that allow customer self-registration. The attacker then issues an authenticated HTTP request to the vulnerable plugin endpoint, supplying parameters that alter checkout field definitions or invoke other privileged plugin actions. Because the handler does not enforce authorization, the request succeeds. Depending on which endpoint is invoked, the attacker can modify persisted plugin data, disrupt the checkout process, or stage further attacks against site administrators.

No public proof-of-concept is available at the time of writing. Refer to the Patchstack Vulnerability Report for advisory-level technical details.

Detection Methods for CVE-2024-31267

Indicators of Compromise

Unexpected modifications to WooCommerce checkout field configuration stored by the flexible_checkout_fields plugin.
Authenticated POST requests from customer-role accounts to plugin admin-ajax.php or admin-post.php actions belonging to Flexible Checkout Fields.
New or altered plugin options in wp_options referencing inspire_checkout_fields or flexible-checkout-fields.
Anomalous checkout behavior reported by legitimate customers, such as missing, added, or malformed fields.

Detection Strategies

Inventory all WordPress sites running Flexible Checkout Fields for WooCommerce and flag any instance at or below version 4.1.2.
Enable WordPress audit logging to capture plugin option changes and administrative action invocations attributed to non-administrator users.
Correlate web server access logs with WordPress user roles to identify low-privilege sessions calling plugin admin endpoints.

Monitoring Recommendations

Alert on HTTP requests to /wp-admin/admin-ajax.php or /wp-admin/admin-post.php where the action parameter references Flexible Checkout Fields and the authenticated user is not an administrator.
Monitor for changes to plugin-managed options and export a baseline of checkout field configuration for tamper detection.
Track creation of new customer accounts followed shortly by authenticated calls to plugin admin endpoints.

How to Mitigate CVE-2024-31267

Immediate Actions Required

Update Flexible Checkout Fields for WooCommerce to a version newer than 4.1.2 as published by WP Desk.
Audit WooCommerce customer accounts for suspicious registrations and rotate credentials for any accounts showing anomalous activity.
Review checkout field configuration and restore known-good values if tampering is detected.
Restrict new user registration where business requirements permit, or gate it with CAPTCHA and email verification.

Patch Information

WP Desk has released fixed versions of the plugin subsequent to 4.1.2. Consult the Patchstack Vulnerability Report and the WordPress.org plugin changelog for the exact fixed version. Apply the update through the WordPress admin dashboard or via wp-cli using wp plugin update flexible-checkout-fields.

Workarounds

Deactivate the plugin until the update can be applied if checkout customization is not business-critical.
Deploy a web application firewall rule that blocks requests to Flexible Checkout Fields admin-ajax and admin-post actions when the authenticated user lacks the manage_woocommerce capability.
Temporarily disable open customer registration to reduce the pool of accounts eligible to exploit the flaw.

bash

# Update the plugin using WP-CLI
wp plugin update flexible-checkout-fields

# Verify installed version
wp plugin get flexible-checkout-fields --field=version

# If required, deactivate the plugin as a temporary workaround
wp plugin deactivate flexible-checkout-fields