CVE-2021-4428: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
value: A vulnerability has been found in what3words Autosuggest Plugin up to 4.0.0 on WordPress and classified as problematic. Affected by this vulnerability is the function enqueue_scripts of the file w3w-autosuggest/public/class-w3w-autosuggest-public.php of the component Setting Handler. The manipulation leads to information disclosure. The attack can be launched remotely. Upgrading to version 4.0.1 is able to address this issue. The patch is named dd59cbac5f86057d6a73b87007c08b8bfa0c32ac. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-234247.
CWE description: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CVSS v3 base score: 7.5
Published: 2023-07-18T17:15Z
Repository: https://github.com/what3words/wordpress-autosuggest-plugin
Language: PHP
Files changed: .gitignore, w3w-autosuggest/CHANGELOG.txt, w3w-autosuggest/README.txt, w3w-autosuggest/public/class-w3w-autosuggest-public.php, w3w-autosuggest/public/js/w3w-autosuggest-public.js, w3w-autosuggest/w3w-autosuggest.php
Commit date: 2022-03-25 08:57:40 +0000
Commit message: [TT-6952] Security Vulnerability Patch [TT-6889] Load Scripts Async (#20)

* add async attr to script elem

* fix security vulnerability

* update readme/changelog and conditionals for exposing settings
Diff: diff --git a/.gitignore b/.gitignore
index 1b911e9..9990784 100644
--- a/.gitignore
+++ b/.gitignore
@@ -210,6 +210,7 @@ test/database/data/*
 node_modules
 autosuggest
 videos
 screenshots
 *.zip
-*.env
\ No newline at end of file
+*.env
+3-word-address-validation-field
\ No newline at end of file
diff --git a/w3w-autosuggest/CHANGELOG.txt b/w3w-autosuggest/CHANGELOG.txt
index 1d53942..073359b 100644
--- a/w3w-autosuggest/CHANGELOG.txt
+++ b/w3w-autosuggest/CHANGELOG.txt
@@ -1,5 +1,10 @@
+= 4.0.1 =
+* Released 2021.11.xx
+* Security vulnerability fixed for `get_option` exposing sensitive information.
+* Loading the w3w autosuggest script asynchronously
+
 = 4.0.0 =
 * Released 2021.07.20
 * Upgraded to use V4 of the what3words AutoSuggest Component with improved styling and functionality.
 * Updated admin section interface.
 * Addition of advanced clipping options to restrict suggestions displayed to a user.
diff --git a/w3w-autosuggest/README.txt b/w3w-autosuggest/README.txt
index 2aca3c5..3a06e01 100644
--- a/w3w-autosuggest/README.txt
+++ b/w3w-autosuggest/README.txt
@@ -1,11 +1,11 @@
 === what3words Address Field ===
 Contributors: what3words
 Tags: what3words, 3 word address, three word address, searchbox, search, address, validation, autosuggest, w3w
 Requires at least: 4.7
 Tested up to: 5.8
-Stable tag: 4.0.0
+Stable tag: 4.0.1
 License: GPLv2 or later
 License URI: http://www.gnu.org/licenses/gpl-2.0.html
 
 Official plugin to allow customers to enter and validate a what3words address on your checkout for accurate deliveries.
 
@@ -143,21 +143,118 @@ Have any questions? Want to learn more about how the what3words Address Field pl
 3. Customize the autosuggest results with advanced features
 
 
 == Changelog ==
 
+= 4.0.1 =
+* Released 2021.11.xx
+* Security vulnerability fixed for `get_option` exposing sensitive information.
+* Loading the w3w autosuggest script asynchronously
+
 = 4.0.0 =
 * Released 2021.07.20
 * Upgraded to use V4 of the what3words AutoSuggest Component with improved styling and functionality.
 * Updated admin section interface.
 * Addition of advanced clipping options to restrict suggestions displayed to a user.
 * Addition of options to store latitude and longitude coordinates and nearest place against a record.
 * Added ability to change the field label.
 
+= 3.0.11 =
+* Released 2021.06.30
+* Fixes non-fatal debugging log output for PHP "Variable assignment" error
+
+= 3.0.10 =
+* Released 2021.03.09
+* Fixes passing API key to autosuggest for requests.
+
+= 3.0.9 =
+* Released 2021.02.03
+* Updated screenshots
+* Send key version numbers to what3words API via `X-W3W-Plugin` request header.
+
+= 3.0.8 =
+* Released 2020.12.11
+* Improved interoperability, errors in 3rd party scripts will be less likely to prevent the plugin operating.
+* Bumped to latest WordPress release, 5.6
+
+= 3.0.7 =
+* Released 2020.06.17
+* Addresses an error that prevented the plugin loading on Internet Explorer.
+* Minor styling improvements.
+
+= 3.0.6 =
+* Released 2020.06.02
+* Further improvements to match theme styling
+* Clarified the purpose of the `Input Selector(s)` field
+* Updated readme
+
+= 3.0.5 =
+* Released 2020.06.01
+* Apply missing `font-size` property.
+
+= 3.0.4 =
+* Released 2020.06.01
+* Hotfix missing `font-size` property.
+
+= 3.0.3 =
+* Released 2020.06.01
+* Plugin tweaked to take up less vertical height on themes with slimmer text inputs.
+
+= 3.0.2 =
+* Released 2020.06.01
+* The plugin now inherits styles from the current wordpress theme for more seamless integration.
+* The following css properties are automatically applied to the upgraded input: `background-color`, `border`, `border-radius`, `color`, `font`, `height`.
+
+= 3.0.1 =
+* Released 2020.05.27
+* Fixes an issue where country clipping would not work when shipping and billing addresses were in different countries.
+* Updated screenshots
+
+= 3.0.0 =
+* Released 2020.05.26
+* Updated the plugin to use new web component and V3 of the what3words API. Note that this release simplifies the plugin setup and removes some settings.
+* Updated links to what3words documentation and developer site
+* Settings available are now: 
+* API key
+* CSS selector to specify which inputs should be upgraded to the auto suggest component
+* Placeholder text shown on inputs
+* Turn on/off the WooCommerce integration, to automatically add what3words address fields to your checkout forms
+
+= 2.0.4 =
+* Released 2019.01.16
+* Added new function to allow a country field to be specified for country clipping
+
+= 2.0.3 =
+* Released 2018.04.05
+* bug fixes
+
+= 2.0.2 =
+* Released 2018.03.16
+* bug fixes
+
+= 2.0.1 =
+* Released 2018.01.09
+* bug fixes
+
+= 2.0.0 =
+* Released 2018.01.08
+* Reworked and redesigned plugin code base
+
+= 1.1.0 =
+* uses what3words autosuggest jQuery plugin 1.2.0
+
+= 1.0.1 =
+* General fixes
+
+= 1.0.0 =
+* Initial release
 
 == Upgrade Notice ==
 
+= 4.0.1 =
+Performance improvements and security vulnerability patch
+
 = 4.0 =
 Upgrade the what3words address field plugin to use the latest version of the what3words AutoSuggest Component and new plugin features.
 
 = 3.0 =
 This is the 9th version of the plugin
diff --git a/w3w-autosuggest/public/class-w3w-autosuggest-public.php b/w3w-autosuggest/public/class-w3w-autosuggest-public.php
index e63c397..6db8e7d 100644
--- a/w3w-autosuggest/public/class-w3w-autosuggest-public.php
+++ b/w3w-autosuggest/public/class-w3w-autosuggest-public.php
@@ -105,14 +105,54 @@ class W3W_Autosuggest_Public {
 	public function enqueue_scripts() {
     global $wp_version;
     global $woocommerce;
 
     $settings = get_option( W3W_SETTINGS_NAME );
-    $settings['wp_version'] = $wp_version;
-    $settings['wc_version'] = isset( $woocommerce ) ? $woocommerce->version : 'N/A';
-    $settings['php_version'] = phpversion();
-    $data = 'const W3W_AUTOSUGGEST_SETTINGS = ' . json_encode( $settings ) . ';';
+    $exposed_settings['version'] = $settings['version'];
+    $exposed_settings['php_version'] = phpversion();
+    $exposed_settings['wp_version'] = $wp_version;
+    $exposed_settings['wc_version'] = isset( $woocommerce ) ? $woocommerce->version : 'N/A';
+    $exposed_settings['api_key'] = $settings['api_key'];
+    if ( isset( $settings['woocommerce_enabled'] ) )
+      $exposed_settings['woocommerce_enabled'] = $settings['woocommerce_enabled'];
+    if ( isset( $settings['enable_placeholder'] ) )
+      $exposed_settings['enable_placeholder'] = $settings['enable_placeholder'];
+    if ( isset( $settings['placeholder'] ) && !empty( $settings['placeholder'] ) )
+      $exposed_settings['placeholder'] = $settings['placeholder'];
+    if ( isset( $settings['enable_label'] ) )
+      $exposed_settings['enable_label'] = $settings['enable_label'];
+    if ( isset( $settings['label'] ) && !empty( $settings['label'] ) )
+      $exposed_settings['label'] = $settings['label'];
+    if ( isset( $settings['save_nearest_place'] ) && !empty( $settings['save_nearest_place'] ) )
+      $exposed_settings['save_nearest_place'] = $settings['save_nearest_place'];
+    if ( isset( $settings['enable_clip_to_country'] ) )
+      $exposed_settings['enable_clip_to_country'] = $settings['enable_clip_to_country'];
+    if ( isset( $settings['clip_to_country'] ) && !empty( $settings['clip_to_country'] ) )
+      $exposed_settings['clip_to_country'] = $settings['clip_to_country'];
+    if ( isset( $settings['enable_clip_to_bounding_box'] ) )
+      $exposed_settings['enable_clip_to_bounding_box'] = $settings['enable_clip_to_bounding_box'];
+    if ( isset( $settings['clip_to_bounding_box_ne_lat'] ) && !empty( $settings['clip_to_bounding_box_ne_lat'] ) )
+      $exposed_settings['clip_to_bounding_box_ne_lat'] = $settings['clip_to_bounding_box_ne_lat'];
+    if ( isset( $settings['clip_to_bounding_box_ne_lng'] ) && !empty( $settings['clip_to_bounding_box_ne_lng'] ) )
+      $exposed_settings['clip_to_bounding_box_ne_lng'] = $settings['clip_to_bounding_box_ne_lng'];
+    if ( isset( $settings['clip_to_bounding_box_sw_lat'] ) && !empty( $settings['clip_to_bounding_box_sw_lat'] ) )
+      $exposed_settings['clip_to_bounding_box_sw_lat'] = $settings['clip_to_bounding_box_sw_lat'];
+    if ( isset( $settings['clip_to_bounding_box_sw_lng'] ) && !empty( $settings['clip_to_bounding_box_sw_lng'] ) )
+      $exposed_settings['clip_to_bounding_box_sw_lng'] = $settings['clip_to_bounding_box_sw_lng'];
+    if ( isset( $settings['enable_clip_to_circle'] ) )
+      $exposed_settings['enable_clip_to_circle'] = $settings['enable_clip_to_circle'];
+    if ( isset( $settings['clip_to_circle_lat'] ) && !empty( $settings['clip_to_circle_lat'] ) )
+      $exposed_settings['clip_to_circle_lat'] = $settings['clip_to_circle_lat'];
+    if ( isset( $settings['clip_to_circle_lng'] ) && !empty( $settings['clip_to_circle_lng'] ) )
+      $exposed_settings['clip_to_circle_lng'] = $settings['clip_to_circle_lng'];
+    if ( isset( $settings['clip_to_circle_radius'] ) && !empty( $settings['clip_to_circle_radius'] ) )
+      $exposed_settings['clip_to_circle_radius'] = $settings['clip_to_circle_radius'];
+    if ( isset( $settings['return_coordinates'] ) )
+      $exposed_settings['return_coordinates'] = $settings['return_coordinates'];
+    if ( isset( $settings['selector'] ) && !empty( $settings['selector'] ) )
+      $exposed_settings['selector'] = $settings['selector'];
+    $data = 'const W3W_AUTOSUGGEST_SETTINGS = ' . json_encode( $exposed_settings ) . ';';
 
     /**
      * Add modular JS component script tag
      */
     wp_enqueue_script(
@@ -169,15 +209,15 @@ class W3W_Autosuggest_Public {
 	 * @since    4.0.0
 	 */
   public function add_attribute( $tag, $handle, $src ) {
 
     if ( $handle === $this->js_comp_esm_lib ) {
-      return '<script type="module" src="' . esc_url( $src ) . '"></script>';
+      return '<script type="module" src="' . esc_url( $src ) . '" async></script>';
     }
 
     if ( $handle === $this->js_comp_webpack_lib ) {
-      return '<script nomodule src="' . esc_url( $src ) . '"></script>';
+      return '<script nomodule src="' . esc_url( $src ) . '" async></script>';
     }
 
     return $tag;
 
   }
diff --git a/w3w-autosuggest/public/js/w3w-autosuggest-public.js b/w3w-autosuggest/public/js/w3w-autosuggest-public.js
index adf27bd..fa23088 100644
--- a/w3w-autosuggest/public/js/w3w-autosuggest-public.js
+++ b/w3w-autosuggest/public/js/w3w-autosuggest-public.js
@@ -138,11 +138,10 @@
         !W3W_AUTOSUGGEST_SETTINGS.enable_clip_to_country &&
         !W3W_AUTOSUGGEST_SETTINGS.enable_clip_to_circle &&
         !W3W_AUTOSUGGEST_SETTINGS.enable_clip_to_bounding_box &&
         !W3W_AUTOSUGGEST_SETTINGS.enable_clip_to_polygon
       ) {
-        console.log('inside')
         billingCountry.on('change', function(e) {
           $('#w3w-billing').closest('what3words-autosuggest').attr('clip_to_country', e.target.value)
         })
         billingCountry.trigger('change')
       }
@@ -180,11 +179,10 @@
         !W3W_AUTOSUGGEST_SETTINGS.enable_clip_to_country &&
         !W3W_AUTOSUGGEST_SETTINGS.enable_clip_to_circle &&
         !W3W_AUTOSUGGEST_SETTINGS.enable_clip_to_bounding_box &&
         !W3W_AUTOSUGGEST_SETTINGS.enable_clip_to_polygon
       ) {
-        console.log('inside')
         shippingCountry.on('change', function(e) {
           $('#w3w-shipping').closest('what3words-autosuggest').attr('clip_to_country', e.target.value)
         })
         shippingCountry.trigger('change')
       }
diff --git a/w3w-autosuggest/w3w-autosuggest.php b/w3w-autosuggest/w3w-autosuggest.php
index eec7c7f..ed5b760 100644
--- a/w3w-autosuggest/w3w-autosuggest.php
+++ b/w3w-autosuggest/w3w-autosuggest.php
@@ -14,11 +14,11 @@
  *
  * @wordpress-plugin
  * Plugin Name:       what3words Address Field
  * Plugin URI:        https://github.com/what3words/wordpress-autosuggest-plugin
  * Description:       Official plugin to allow customers to enter and validate a what3words address on your checkout for accurate deliveries
- * Version:           4.0.0
+ * Version:           4.0.1
  * Author:            what3words
  * Author URI:        https://what3words.com
  * License:           GPL-2.0+
  * License URI:       http://www.gnu.org/licenses/gpl-2.0.txt
  * Text Domain:       what3words-searchbox
@@ -53,11 +53,11 @@ if ( !defined( 'W3W_AUTOSUGGEST_PLUGIN_BASENAME' ) ) {
 }
 /**
  * Current plugin version.
  */
 if ( !defined( 'W3W_PLUGIN_VERSION' ) ) {
-  define( 'W3W_PLUGIN_VERSION', '4.0.0' );
+  define( 'W3W_PLUGIN_VERSION', '4.0.1' );
 }
 /**
  * Plugin settings name
  */
 if ( !defined( 'W3W_SETTINGS_NAME' ) ) {
@@ -66,11 +66,11 @@ if ( !defined( 'W3W_SETTINGS_NAME' ) ) {
 
 /**
  * Defines the JS-library to point to (includes the version of the JS-library)
  */
 if ( !defined( 'W3W_JS_LIB_CDN_URL' ) ) {
-  define ( 'W3W_JS_LIB_CDN_URL', 'https://cdn.what3words.com/javascript-components@4.0.0/dist/what3words' );
+  define ( 'W3W_JS_LIB_CDN_URL', 'https://cdn.what3words.com/javascript-components@4.0.3/dist/what3words' );
 }
 
 /**
  * Defines the internationalisation domain
  */

Vulnerable code: *.env
Stable tag: 4.0.0
    $settings['wp_version'] = $wp_version;
    $settings['wc_version'] = isset( $woocommerce ) ? $woocommerce->version : 'N/A';
    $settings['php_version'] = phpversion();
    $data = 'const W3W_AUTOSUGGEST_SETTINGS = ' . json_encode( $settings ) . ';';
      return '<script type="module" src="' . esc_url( $src ) . '"></script>';
      return '<script nomodule src="' . esc_url( $src ) . '"></script>';
        console.log('inside')
        console.log('inside')
 * Version:           4.0.0
  define( 'W3W_PLUGIN_VERSION', '4.0.0' );
  define ( 'W3W_JS_LIB_CDN_URL', 'https://cdn.what3words.com/javascript-components@4.0.0/dist/what3words' );
Fixed code: *.env
3-word-address-validation-field
= 4.0.1 =
* Released 2021.11.xx
* Security vulnerability fixed for `get_option` exposing sensitive information.
* Loading the w3w autosuggest script asynchronously

Stable tag: 4.0.1
= 4.0.1 =
* Released 2021.11.xx
* Security vulnerability fixed for `get_option` exposing sensitive information.
* Loading the w3w autosuggest script asynchronously

= 3.0.11 =
* Released 2021.06.30
* Fixes non-fatal debugging log output for PHP "Variable assignment" error

= 3.0.10 =
* Released 2021.03.09
* Fixes passing API key to autosuggest for requests.

= 3.0.9 =
* Released 2021.02.03
* Updated screenshots
* Send key version numbers to what3words API via `X-W3W-Plugin` request header.

= 3.0.8 =
* Released 2020.12.11
* Improved interoperability, errors in 3rd party scripts will be less likely to prevent the plugin operating.
* Bumped to latest WordPress release, 5.6

= 3.0.7 =
* Released 2020.06.17
* Addresses an error that prevented the plugin loading on Internet Explorer.
* Minor styling improvements.

= 3.0.6 =
* Released 2020.06.02
* Further improvements to match theme styling
* Clarified the purpose of the `Input Selector(s)` field
* Updated readme

= 3.0.5 =
* Released 2020.06.01
* Apply missing `font-size` property.

= 3.0.4 =
* Released 2020.06.01
* Hotfix missing `font-size` property.

= 3.0.3 =
* Released 2020.06.01
* Plugin tweaked to take up less vertical height on themes with slimmer text inputs.

= 3.0.2 =
* Released 2020.06.01
* The plugin now inherits styles from the current wordpress theme for more seamless integration.
* The following css properties are automatically applied to the upgraded input: `background-color`, `border`, `border-radius`, `color`, `font`, `height`.

= 3.0.1 =
* Released 2020.05.27
* Fixes an issue where country clipping would not work when shipping and billing addresses were in different countries.
* Updated screenshots

= 3.0.0 =
* Released 2020.05.26
* Updated the plugin to use new web component and V3 of the what3words API. Note that this release simplifies the plugin setup and removes some settings.
* Updated links to what3words documentation and developer site
* Settings available are now: 
* API key
* CSS selector to specify which inputs should be upgraded to the auto suggest component
* Placeholder text shown on inputs
* Turn on/off the WooCommerce integration, to automatically add what3words address fields to your checkout forms

= 2.0.4 =
* Released 2019.01.16
* Added new function to allow a country field to be specified for country clipping

= 2.0.3 =
* Released 2018.04.05
* bug fixes

= 2.0.2 =
* Released 2018.03.16
* bug fixes

= 2.0.1 =
* Released 2018.01.09
* bug fixes

= 2.0.0 =
* Released 2018.01.08
* Reworked and redesigned plugin code base

= 1.1.0 =
* uses what3words autosuggest jQuery plugin 1.2.0

= 1.0.1 =
* General fixes

= 1.0.0 =
* Initial release
= 4.0.1 =
Performance improvements and security vulnerability patch

    $exposed_settings['version'] = $settings['version'];
    $exposed_settings['php_version'] = phpversion();
    $exposed_settings['wp_version'] = $wp_version;
    $exposed_settings['wc_version'] = isset( $woocommerce ) ? $woocommerce->version : 'N/A';
    $exposed_settings['api_key'] = $settings['api_key'];
    if ( isset( $settings['woocommerce_enabled'] ) )
      $exposed_settings['woocommerce_enabled'] = $settings['woocommerce_enabled'];
    if ( isset( $settings['enable_placeholder'] ) )
      $exposed_settings['enable_placeholder'] = $settings['enable_placeholder'];
    if ( isset( $settings['placeholder'] ) && !empty( $settings['placeholder'] ) )
      $exposed_settings['placeholder'] = $settings['placeholder'];
    if ( isset( $settings['enable_label'] ) )
      $exposed_settings['enable_label'] = $settings['enable_label'];
    if ( isset( $settings['label'] ) && !empty( $settings['label'] ) )
      $exposed_settings['label'] = $settings['label'];
    if ( isset( $settings['save_nearest_place'] ) && !empty( $settings['save_nearest_place'] ) )
      $exposed_settings['save_nearest_place'] = $settings['save_nearest_place'];
    if ( isset( $settings['enable_clip_to_country'] ) )
      $exposed_settings['enable_clip_to_country'] = $settings['enable_clip_to_country'];
    if ( isset( $settings['clip_to_country'] ) && !empty( $settings['clip_to_country'] ) )
      $exposed_settings['clip_to_country'] = $settings['clip_to_country'];
    if ( isset( $settings['enable_clip_to_bounding_box'] ) )
      $exposed_settings['enable_clip_to_bounding_box'] = $settings['enable_clip_to_bounding_box'];
    if ( isset( $settings['clip_to_bounding_box_ne_lat'] ) && !empty( $settings['clip_to_bounding_box_ne_lat'] ) )
      $exposed_settings['clip_to_bounding_box_ne_lat'] = $settings['clip_to_bounding_box_ne_lat'];
    if ( isset( $settings['clip_to_bounding_box_ne_lng'] ) && !empty( $settings['clip_to_bounding_box_ne_lng'] ) )
      $exposed_settings['clip_to_bounding_box_ne_lng'] = $settings['clip_to_bounding_box_ne_lng'];
    if ( isset( $settings['clip_to_bounding_box_sw_lat'] ) && !empty( $settings['clip_to_bounding_box_sw_lat'] ) )
      $exposed_settings['clip_to_bounding_box_sw_lat'] = $settings['clip_to_bounding_box_sw_lat'];
    if ( isset( $settings['clip_to_bounding_box_sw_lng'] ) && !empty( $settings['clip_to_bounding_box_sw_lng'] ) )
      $exposed_settings['clip_to_bounding_box_sw_lng'] = $settings['clip_to_bounding_box_sw_lng'];
    if ( isset( $settings['enable_clip_to_circle'] ) )
      $exposed_settings['enable_clip_to_circle'] = $settings['enable_clip_to_circle'];
    if ( isset( $settings['clip_to_circle_lat'] ) && !empty( $settings['clip_to_circle_lat'] ) )
      $exposed_settings['clip_to_circle_lat'] = $settings['clip_to_circle_lat'];
    if ( isset( $settings['clip_to_circle_lng'] ) && !empty( $settings['clip_to_circle_lng'] ) )
      $exposed_settings['clip_to_circle_lng'] = $settings['clip_to_circle_lng'];
    if ( isset( $settings['clip_to_circle_radius'] ) && !empty( $settings['clip_to_circle_radius'] ) )
      $exposed_settings['clip_to_circle_radius'] = $settings['clip_to_circle_radius'];
    if ( isset( $settings['return_coordinates'] ) )
      $exposed_settings['return_coordinates'] = $settings['return_coordinates'];
    if ( isset( $settings['selector'] ) && !empty( $settings['selector'] ) )
      $exposed_settings['selector'] = $settings['selector'];
    $data = 'const W3W_AUTOSUGGEST_SETTINGS = ' . json_encode( $exposed_settings ) . ';';
      return '<script type="module" src="' . esc_url( $src ) . '" async></script>';
      return '<script nomodule src="' . esc_url( $src ) . '" async></script>';
 * Version:           4.0.1
  define( 'W3W_PLUGIN_VERSION', '4.0.1' );
  define ( 'W3W_JS_LIB_CDN_URL', 'https://cdn.what3words.com/javascript-components@4.0.3/dist/what3words' );