Advanced Woo Labels Remote Code Execution Vulnerability

A remote code execution vulnerability exists in the Advanced Woo Labels plugin for WordPress, affecting all versions through 2.37. The issue arises from the 'get_select_option_values()' AJAX handler, which uses 'call_user_func_array()' with user-controlled callbacks and parameters, lacking a proper allowlist or capability check. This vulnerability allows authenticated attackers with Contributor-level access and above to execute arbitrary PHP functions and operating system commands on the server via the 'callback' parameter.

Impact

Exploitation of this vulnerability allows for remote code execution on the server.

Reproduction

To reproduce this vulnerability, an authenticated user with Contributor-level access or higher can send a request to the 'get_select_option_values()' AJAX handler. The request must include a 'callback' parameter with a value that corresponds to a legitimate callback function in the WordPress environment. The absence of a callback allowlist or proper capability checks enables the execution of arbitrary code.

Remediation

Users are advised to update the Advanced Woo Labels plugin to version 2.37 or later.