CVE-2021-4428 (PHP, published 2023-07-18T17:15Z)
Description: value: A vulnerability has been found in what3words Autosuggest Plugin up to 4.0.0 on WordPress and classified as problematic. Affected by this vulnerability is the function enqueue_scripts of the file w3w-autosuggest/public/class-w3w-autosuggest-public.php of the component Setting Handler. The manipulation leads to information disclosure. The attack can be launched remotely. Upgrading to version 4.0.1 is able to address this issue. The patch is named dd59cbac5f86057d6a73b87007c08b8bfa0c32ac. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-234247.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/what3words/wordpress-autosuggest-plugin
Files changed:
.gitignore
w3w-autosuggest/CHANGELOG.txt
w3w-autosuggest/README.txt
w3w-autosuggest/public/class-w3w-autosuggest-public.php
w3w-autosuggest/public/js/w3w-autosuggest-public.js
w3w-autosuggest/w3w-autosuggest.php
Commit message: [TT-6952] Security Vulnerability Patch [TT-6889] Load Scripts Async (#20)

* add async attr to script elem

* fix security vulnerability

* update readme/changelog and conditionals for exposing settings

Vulnerable code:
*.env
Stable tag: 4.0.0
    $settings['wp_version'] = $wp_version;
    $settings['wc_version'] = isset( $woocommerce ) ? $woocommerce->version : 'N/A';
    $settings['php_version'] = phpversion();
    $data = 'const W3W_AUTOSUGGEST_SETTINGS = ' . json_encode( $settings ) . ';';
      return '<script type="module" src="' . esc_url( $src ) . '"></script>';
      return '<script nomodule src="' . esc_url( $src ) . '"></script>';
        console.log('inside')
        console.log('inside')
 * Version:           4.0.0
  define( 'W3W_PLUGIN_VERSION', '4.0.0' );
  define ( 'W3W_JS_LIB_CDN_URL', 'https://cdn.what3words.com/javascript-components@4.0.0/dist/what3words' );

Fixed code:
*.env
3-word-address-validation-field
= 4.0.1 =
* Released 2021.11.xx
* Security vulnerability fixed for `get_option` exposing sensitive information.
* Loading the w3w autosuggest script asynchronously

Stable tag: 4.0.1
= 4.0.1 =
* Released 2021.11.xx
* Security vulnerability fixed for `get_option` exposing sensitive information.
* Loading the w3w autosuggest script asynchronously

= 3.0.11 =
* Released 2021.06.30
* Fixes non-fatal debugging log output for PHP "Variable assignment" error

= 3.0.10 =
* Released 2021.03.09
* Fixes passing API key to autosuggest for requests.

= 3.0.9 =
* Released 2021.02.03
* Updated screenshots
* Send key version numbers to what3words API via `X-W3W-Plugin` request header.

= 3.0.8 =
* Released 2020.12.11
* Improved interoperability, errors in 3rd party scripts will be less likely to prevent the plugin operating.
* Bumped to latest WordPress release, 5.6

= 3.0.7 =
* Released 2020.06.17
* Addresses an error that prevented the plugin loading on Internet Explorer.
* Minor styling improvements.

= 3.0.6 =
* Released 2020.06.02
* Further improvements to match theme styling
* Clarified the purpose of the `Input Selector(s)` field
* Updated readme

= 3.0.5 =
* Released 2020.06.01
* Apply missing `font-size` property.

= 3.0.4 =
* Released 2020.06.01
* Hotfix missing `font-size` property.

= 3.0.3 =
* Released 2020.06.01
* Plugin tweaked to take up less vertical height on themes with slimmer text inputs.

= 3.0.2 =
* Released 2020.06.01
* The plugin now inherits styles from the current wordpress theme for more seamless integration.
* The following css properties are automatically applied to the upgraded input: `background-color`, `border`, `border-radius`, `color`, `font`, `height`.

= 3.0.1 =
* Released 2020.05.27
* Fixes an issue where country clipping would not work when shipping and billing addresses were in different countries.
* Updated screenshots

= 3.0.0 =
* Released 2020.05.26
* Updated the plugin to use new web component and V3 of the what3words API. Note that this release simplifies the plugin setup and removes some settings.
* Updated links to what3words documentation and developer site
* Settings available are now: 
* API key
* CSS selector to specify which inputs should be upgraded to the auto suggest component
* Placeholder text shown on inputs
* Turn on/off the WooCommerce integration, to automatically add what3words address fields to your checkout forms

= 2.0.4 =
* Released 2019.01.16
* Added new function to allow a country field to be specified for country clipping

= 2.0.3 =
* Released 2018.04.05
* bug fixes

= 2.0.2 =
* Released 2018.03.16
* bug fixes

= 2.0.1 =
* Released 2018.01.09
* bug fixes

= 2.0.0 =
* Released 2018.01.08
* Reworked and redesigned plugin code base

= 1.1.0 =
* uses what3words autosuggest jQuery plugin 1.2.0

= 1.0.1 =
* General fixes

= 1.0.0 =
* Initial release
= 4.0.1 =
Performance improvements and security vulnerability patch

    $exposed_settings['version'] = $settings['version'];
    $exposed_settings['php_version'] = phpversion();
    $exposed_settings['wp_version'] = $wp_version;
    $exposed_settings['wc_version'] = isset( $woocommerce ) ? $woocommerce->version : 'N/A';
    $exposed_settings['api_key'] = $settings['api_key'];
    if ( isset( $settings['woocommerce_enabled'] ) )
      $exposed_settings['woocommerce_enabled'] = $settings['woocommerce_enabled'];
    if ( isset( $settings['enable_placeholder'] ) )
      $exposed_settings['enable_placeholder'] = $settings['enable_placeholder'];
    if ( isset( $settings['placeholder'] ) && !empty( $settings['placeholder'] ) )
      $exposed_settings['placeholder'] = $settings['placeholder'];
    if ( isset( $settings['enable_label'] ) )
      $exposed_settings['enable_label'] = $settings['enable_label'];
    if ( isset( $settings['label'] ) && !empty( $settings['label'] ) )
      $exposed_settings['label'] = $settings['label'];
    if ( isset( $settings['save_nearest_place'] ) && !empty( $settings['save_nearest_place'] ) )
      $exposed_settings['save_nearest_place'] = $settings['save_nearest_place'];
    if ( isset( $settings['enable_clip_to_country'] ) )
      $exposed_settings['enable_clip_to_country'] = $settings['enable_clip_to_country'];
    if ( isset( $settings['clip_to_country'] ) && !empty( $settings['clip_to_country'] ) )
      $exposed_settings['clip_to_country'] = $settings['clip_to_country'];
    if ( isset( $settings['enable_clip_to_bounding_box'] ) )
      $exposed_settings['enable_clip_to_bounding_box'] = $settings['enable_clip_to_bounding_box'];
    if ( isset( $settings['clip_to_bounding_box_ne_lat'] ) && !empty( $settings['clip_to_bounding_box_ne_lat'] ) )
      $exposed_settings['clip_to_bounding_box_ne_lat'] = $settings['clip_to_bounding_box_ne_lat'];
    if ( isset( $settings['clip_to_bounding_box_ne_lng'] ) && !empty( $settings['clip_to_bounding_box_ne_lng'] ) )
      $exposed_settings['clip_to_bounding_box_ne_lng'] = $settings['clip_to_bounding_box_ne_lng'];
    if ( isset( $settings['clip_to_bounding_box_sw_lat'] ) && !empty( $settings['clip_to_bounding_box_sw_lat'] ) )
      $exposed_settings['clip_to_bounding_box_sw_lat'] = $settings['clip_to_bounding_box_sw_lat'];
    if ( isset( $settings['clip_to_bounding_box_sw_lng'] ) && !empty( $settings['clip_to_bounding_box_sw_lng'] ) )
      $exposed_settings['clip_to_bounding_box_sw_lng'] = $settings['clip_to_bounding_box_sw_lng'];
    if ( isset( $settings['enable_clip_to_circle'] ) )
      $exposed_settings['enable_clip_to_circle'] = $settings['enable_clip_to_circle'];
    if ( isset( $settings['clip_to_circle_lat'] ) && !empty( $settings['clip_to_circle_lat'] ) )
      $exposed_settings['clip_to_circle_lat'] = $settings['clip_to_circle_lat'];
    if ( isset( $settings['clip_to_circle_lng'] ) && !empty( $settings['clip_to_circle_lng'] ) )
      $exposed_settings['clip_to_circle_lng'] = $settings['clip_to_circle_lng'];
    if ( isset( $settings['clip_to_circle_radius'] ) && !empty( $settings['clip_to_circle_radius'] ) )
      $exposed_settings['clip_to_circle_radius'] = $settings['clip_to_circle_radius'];
    if ( isset( $settings['return_coordinates'] ) )
      $exposed_settings['return_coordinates'] = $settings['return_coordinates'];
    if ( isset( $settings['selector'] ) && !empty( $settings['selector'] ) )
      $exposed_settings['selector'] = $settings['selector'];
    $data = 'const W3W_AUTOSUGGEST_SETTINGS = ' . json_encode( $exposed_settings ) . ';';
      return '<script type="module" src="' . esc_url( $src ) . '" async></script>';
      return '<script nomodule src="' . esc_url( $src ) . '" async></script>';
 * Version:           4.0.1
  define( 'W3W_PLUGIN_VERSION', '4.0.1' );
  define ( 'W3W_JS_LIB_CDN_URL', 'https://cdn.what3words.com/javascript-components@4.0.3/dist/what3words' );