CVE-2021-4428 (published 2023-07-18T17:15Z)

A vulnerability has been found in what3words Autosuggest Plugin up to 4.0.0 on WordPress and classified as problematic. Affected by this vulnerability is the function enqueue_scripts of the file w3w-autosuggest/public/class-w3w-autosuggest-public.php of the component Setting Handler. The manipulation leads to information disclosure. The attack can be launched remotely. Upgrading to version 4.0.1 is able to address this issue. The patch is named dd59cbac5f86057d6a73b87007c08b8bfa0c32ac. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-234247.

CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-200
cwe_name: Exposure of Sensitive Information to an Unauthorized Actor
description: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
extended_description: 
	   There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
       
         private, personal information, such as personal messages, financial data, health records, geographic location, or contact details
         system status and environment, such as the operating system and installed packages
		 business secrets and intellectual property
		 network status and configuration
		 the product's own code or internal state
         metadata, e.g. logging of connections or message headers
		 indirect information, such as a discrepancy between two internal operations that can be observed by an outsider
       
	    Information might be sensitive to different parties, each of which may have their own expectations for whether the information should be protected.  These parties include:
               
                  the product's own users
                  people or organizations whose information is created or used by the product, even if they are not direct product users
		  the product's administrators, including the admins of the system(s) and/or networks on which the product operates
                  the developer
               
	    Information exposures can occur in different ways:
               
                  the code explicitly inserts sensitive information into resources or messages that are intentionally made accessible to unauthorized actors, but should not contain the information - i.e., the information should have been "scrubbed" or "sanitized"
                  a different weakness or mistake indirectly inserts the sensitive information into resources, such as a web script error revealing the full system path of the program.
                  the code manages resources that intentionally contain sensitive information, but the resources are unintentionally made accessible to unauthorized actors. In this case, the information exposure is resultant - i.e., a different weakness enabled the access to the information in the first place.
               
	    It is common practice to describe any loss of confidentiality as an "information exposure," but this can lead to overuse of CWE-200 in CWE mapping. From the CWE perspective, loss of confidentiality is a technical impact that can arise from dozens of different weaknesses, such as insecure file permissions or out-of-bounds read.  CWE-200 and its lower-level descendants are intended to cover the mistakes that occur in behaviors that explicitly manage, store, transfer, or cleanse sensitive information.
         
         

Fix information:
repo_url: https://github.com/what3words/wordpress-autosuggest-plugin
commit_details: repo_url: https://github.com/what3words/wordpress-autosuggest-plugin
author: Chris Shaw
author_date: 2022-03-25 08:57:40+00:00
msg: [TT-6952] Security Vulnerability Patch [TT-6889] Load Scripts Async (#20)

* add async attr to script elem

* fix security vulnerability

* update readme/changelog and conditionals for exposing settings
repository: repo_url: https://github.com/what3words/wordpress-autosuggest-plugin
repo_name: what3words/wordpress-autosuggest-plugin
description: what3words wordpress autosuggest plugin
repo_language: PHP
owner: what3words
file_changes: filename: .gitignore
change_type: ModificationType.MODIFY
diff: @@ -212,4 +212,5 @@ autosuggest
 videos
 screenshots
 *.zip
-*.env
\ No newline at end of file
+*.env
+3-word-address-validation-field
\ No newline at end of file

programming_language: Shell
filename: CHANGELOG.txt
change_type: ModificationType.MODIFY
diff: @@ -1,3 +1,8 @@
+= 4.0.1 =
+* Released 2021.11.xx
+* Security vulnerability fixed for `get_option` exposing sensitive information.
+* Loading the w3w autosuggest script asynchronously
+
 = 4.0.0 =
 * Released 2021.07.20
 * Upgraded to use V4 of the what3words AutoSuggest Component with improved styling and functionality.

programming_language: Markdown
filename: README.txt
change_type: ModificationType.MODIFY
diff: @@ -3,7 +3,7 @@ Contributors: what3words
 Tags: what3words, 3 word address, three word address, searchbox, search, address, validation, autosuggest, w3w
 Requires at least: 4.7
 Tested up to: 5.8
-Stable tag: 4.0.0
+Stable tag: 4.0.1
 License: GPLv2 or later
 License URI: http://www.gnu.org/licenses/gpl-2.0.html
 
@@ -145,6 +145,11 @@ Have any questions? Want to learn more about how the what3words Address Field pl
 
 == Changelog ==
 
+= 4.0.1 =
+* Released 2021.11.xx
+* Security vulnerability fixed for `get_option` exposing sensitive information.
+* Loading the w3w autosuggest script asynchronously
+
 = 4.0.0 =
 * Released 2021.07.20
 * Upgraded to use V4 of the what3words AutoSuggest Component with improved styling and functionality.
@@ -153,9 +158,101 @@ Have any questions? Want to learn more about how the what3words Address Field pl
 * Addition of options to store latitude and longitude coordinates and nearest place against a record.
 * Added ability to change the field label.
 
+= 3.0.11 =
+* Released 2021.06.30
+* Fixes non-fatal debugging log output for PHP "Variable assignment" error
+
+= 3.0.10 =
+* Released 2021.03.09
+* Fixes passing API key to autosuggest for requests.
+
+= 3.0.9 =
+* Released 2021.02.03
+* Updated screenshots
+* Send key version numbers to what3words API via `X-W3W-Plugin` request header.
+
+= 3.0.8 =
+* Released 2020.12.11
+* Improved interoperability, errors in 3rd party scripts will be less likely to prevent the plugin operating.
+* Bumped to latest WordPress release, 5.6
+
+= 3.0.7 =
+* Released 2020.06.17
+* Addresses an error that prevented the plugin loading on Internet Explorer.
+* Minor styling improvements.
+
+= 3.0.6 =
+* Released 2020.06.02
+* Further improvements to match theme styling
+* Clarified the purpose of the `Input Selector(s)` field
+* Updated readme
+
+= 3.0.5 =
+* Released 2020.06.01
+* Apply missing `font-size` property.
+
+= 3.0.4 =
+* Released 2020.06.01
+* Hotfix missing `font-size` property.
+
+= 3.0.3 =
+* Released 2020.06.01
+* Plugin tweaked to take up less vertical height on themes with slimmer text inputs.
+
+= 3.0.2 =
+* Released 2020.06.01
+* The plugin now inherits styles from the current wordpress theme for more seamless integration.
+* The following css properties are automatically applied to the upgraded input: `background-color`, `border`, `border-radius`, `color`, `font`, `height`.
+
+= 3.0.1 =
+* Released 2020.05.27
+* Fixes an issue where country clipping would not work when shipping and billing addresses were in different countries.
+* Updated screenshots
+
+= 3.0.0 =
+* Released 2020.05.26
+* Updated the plugin to use new web component and V3 of the what3words API. Note that this release simplifies the plugin setup and removes some settings.
+* Updated links to what3words documentation and developer site
+* Settings available are now: 
+* API key
+* CSS selector to specify which inputs should be upgraded to the auto suggest component
+* Placeholder text shown on inputs
+* Turn on/off the WooCommerce integration, to automatically add what3words address fields to your checkout forms
+
+= 2.0.4 =
+* Released 2019.01.16
+* Added new function to allow a country field to be specified for country clipping
+
+= 2.0.3 =
+* Released 2018.04.05
+* bug fixes
+
+= 2.0.2 =
+* Released 2018.03.16
+* bug fixes
+
+= 2.0.1 =
+* Released 2018.01.09
+* bug fixes
+
+= 2.0.0 =
+* Released 2018.01.08
+* Reworked and redesigned plugin code base
+
+= 1.1.0 =
+* uses what3words autosuggest jQuery plugin 1.2.0
+
+= 1.0.1 =
+* General fixes
+
+= 1.0.0 =
+* Initial release
 
 == Upgrade Notice ==
 
+= 4.0.1 =
+Performance improvements and security vulnerability patch
+
 = 4.0 =
 Upgrade the what3words address field plugin to use the latest version of the what3words AutoSuggest Component and new plugin features.
 

programming_language: Markdown
filename: class-w3w-autosuggest-public.php
change_type: ModificationType.MODIFY
diff: @@ -107,10 +107,50 @@ class W3W_Autosuggest_Public {
     global $woocommerce;
 
     $settings = get_option( W3W_SETTINGS_NAME );
-    $settings['wp_version'] = $wp_version;
-    $settings['wc_version'] = isset( $woocommerce ) ? $woocommerce->version : 'N/A';
-    $settings['php_version'] = phpversion();
-    $data = 'const W3W_AUTOSUGGEST_SETTINGS = ' . json_encode( $settings ) . ';';
+    $exposed_settings['version'] = $settings['version'];
+    $exposed_settings['php_version'] = phpversion();
+    $exposed_settings['wp_version'] = $wp_version;
+    $exposed_settings['wc_version'] = isset( $woocommerce ) ? $woocommerce->version : 'N/A';
+    $exposed_settings['api_key'] = $settings['api_key'];
+    if ( isset( $settings['woocommerce_enabled'] ) )
+      $exposed_settings['woocommerce_enabled'] = $settings['woocommerce_enabled'];
+    if ( isset( $settings['enable_placeholder'] ) )
+      $exposed_settings['enable_placeholder'] = $settings['enable_placeholder'];
+    if ( isset( $settings['placeholder'] ) && !empty( $settings['placeholder'] ) )
+      $exposed_settings['placeholder'] = $settings['placeholder'];
+    if ( isset( $settings['enable_label'] ) )
+      $exposed_settings['enable_label'] = $settings['enable_label'];
+    if ( isset( $settings['label'] ) && !empty( $settings['label'] ) )
+      $exposed_settings['label'] = $settings['label'];
+    if ( isset( $settings['save_nearest_place'] ) && !empty( $settings['save_nearest_place'] ) )
+      $exposed_settings['save_nearest_place'] = $settings['save_nearest_place'];
+    if ( isset( $settings['enable_clip_to_country'] ) )
+      $exposed_settings['enable_clip_to_country'] = $settings['enable_clip_to_country'];
+    if ( isset( $settings['clip_to_country'] ) && !empty( $settings['clip_to_country'] ) )
+      $exposed_settings['clip_to_country'] = $settings['clip_to_country'];
+    if ( isset( $settings['enable_clip_to_bounding_box'] ) )
+      $exposed_settings['enable_clip_to_bounding_box'] = $settings['enable_clip_to_bounding_box'];
+    if ( isset( $settings['clip_to_bounding_box_ne_lat'] ) && !empty( $settings['clip_to_bounding_box_ne_lat'] ) )
+      $exposed_settings['clip_to_bounding_box_ne_lat'] = $settings['clip_to_bounding_box_ne_lat'];
+    if ( isset( $settings['clip_to_bounding_box_ne_lng'] ) && !empty( $settings['clip_to_bounding_box_ne_lng'] ) )
+      $exposed_settings['clip_to_bounding_box_ne_lng'] = $settings['clip_to_bounding_box_ne_lng'];
+    if ( isset( $settings['clip_to_bounding_box_sw_lat'] ) && !empty( $settings['clip_to_bounding_box_sw_lat'] ) )
+      $exposed_settings['clip_to_bounding_box_sw_lat'] = $settings['clip_to_bounding_box_sw_lat'];
+    if ( isset( $settings['clip_to_bounding_box_sw_lng'] ) && !empty( $settings['clip_to_bounding_box_sw_lng'] ) )
+      $exposed_settings['clip_to_bounding_box_sw_lng'] = $settings['clip_to_bounding_box_sw_lng'];
+    if ( isset( $settings['enable_clip_to_circle'] ) )
+      $exposed_settings['enable_clip_to_circle'] = $settings['enable_clip_to_circle'];
+    if ( isset( $settings['clip_to_circle_lat'] ) && !empty( $settings['clip_to_circle_lat'] ) )
+      $exposed_settings['clip_to_circle_lat'] = $settings['clip_to_circle_lat'];
+    if ( isset( $settings['clip_to_circle_lng'] ) && !empty( $settings['clip_to_circle_lng'] ) )
+      $exposed_settings['clip_to_circle_lng'] = $settings['clip_to_circle_lng'];
+    if ( isset( $settings['clip_to_circle_radius'] ) && !empty( $settings['clip_to_circle_radius'] ) )
+      $exposed_settings['clip_to_circle_radius'] = $settings['clip_to_circle_radius'];
+    if ( isset( $settings['return_coordinates'] ) )
+      $exposed_settings['return_coordinates'] = $settings['return_coordinates'];
+    if ( isset( $settings['selector'] ) && !empty( $settings['selector'] ) )
+      $exposed_settings['selector'] = $settings['selector'];
+    $data = 'const W3W_AUTOSUGGEST_SETTINGS = ' . json_encode( $exposed_settings ) . ';';
 
     /**
      * Add modular JS component script tag
@@ -171,11 +211,11 @@ class W3W_Autosuggest_Public {
   public function add_attribute( $tag, $handle, $src ) {
 
     if ( $handle === $this->js_comp_esm_lib ) {
-      return '<script type="module" src="' . esc_url( $src ) . '"></script>';
+      return '<script type="module" src="' . esc_url( $src ) . '" async></script>';
     }
 
     if ( $handle === $this->js_comp_webpack_lib ) {
-      return '<script nomodule src="' . esc_url( $src ) . '"></script>';
+      return '<script nomodule src="' . esc_url( $src ) . '" async></script>';
     }
 
     return $tag;

programming_language: PHP
filename: w3w-autosuggest-public.js
change_type: ModificationType.MODIFY
diff: @@ -140,7 +140,6 @@
         !W3W_AUTOSUGGEST_SETTINGS.enable_clip_to_bounding_box &&
         !W3W_AUTOSUGGEST_SETTINGS.enable_clip_to_polygon
       ) {
-        console.log('inside')
         billingCountry.on('change', function(e) {
           $('#w3w-billing').closest('what3words-autosuggest').attr('clip_to_country', e.target.value)
         })
@@ -182,7 +181,6 @@
         !W3W_AUTOSUGGEST_SETTINGS.enable_clip_to_bounding_box &&
         !W3W_AUTOSUGGEST_SETTINGS.enable_clip_to_polygon
       ) {
-        console.log('inside')
         shippingCountry.on('change', function(e) {
           $('#w3w-shipping').closest('what3words-autosuggest').attr('clip_to_country', e.target.value)
         })

programming_language: JavaScript
filename: w3w-autosuggest.php
change_type: ModificationType.MODIFY
diff: @@ -16,7 +16,7 @@
  * Plugin Name:       what3words Address Field
  * Plugin URI:        https://github.com/what3words/wordpress-autosuggest-plugin
  * Description:       Official plugin to allow customers to enter and validate a what3words address on your checkout for accurate deliveries
- * Version:           4.0.0
+ * Version:           4.0.1
  * Author:            what3words
  * Author URI:        https://what3words.com
  * License:           GPL-2.0+
@@ -55,7 +55,7 @@ if ( !defined( 'W3W_AUTOSUGGEST_PLUGIN_BASENAME' ) ) {
  * Current plugin version.
  */
 if ( !defined( 'W3W_PLUGIN_VERSION' ) ) {
-  define( 'W3W_PLUGIN_VERSION', '4.0.0' );
+  define( 'W3W_PLUGIN_VERSION', '4.0.1' );
 }
 /**
  * Plugin settings name
@@ -68,7 +68,7 @@ if ( !defined( 'W3W_SETTINGS_NAME' ) ) {
  * Defines the JS-library to point to (includes the version of the JS-library)
  */
 if ( !defined( 'W3W_JS_LIB_CDN_URL' ) ) {
-  define ( 'W3W_JS_LIB_CDN_URL', 'https://cdn.what3words.com/javascript-components@4.0.0/dist/what3words' );
+  define ( 'W3W_JS_LIB_CDN_URL', 'https://cdn.what3words.com/javascript-components@4.0.3/dist/what3words' );
 }
 
 /**

programming_language: PHP