hutchman

Blogvault flagging it as well.

AdRotate Vulnerability
Category:PLUGIN

Versions-Affected:<= 5.9

Type:Cross Site Request Forgery

Severity:MEDIUM

Description:Multiple Cross-Site Request Forgery (CSRF) vulnerabilities leading to resetting some of the maintenance settings (Reset tasks, Disable the third party, Update Database) were discovered by Muhammad Daffa (Patchstack Alliance) in the WordPress AdRotate Banner Manager plugin (versions <= 5.9).

Yes. I am having the same problem.

I Hope so too. What plugin are you using to rebuild?

Same experience here. This is very concerning.

@doncarlos123 – Which plugin was not compatible if you don’t mind me asking.

Hi again Elvira. I did create a usual WC check out page and the the CC section does indeed display normally.

So, I am using a custom Checkout page instead of the standard WooCommerce Checkout Page., Is that a problem with thins plugin?

I SERIOUSLY need a resolution to this issue. I need to launch the site and thins is the only thing holding me up.

@prophet108 – Yeah that’s not it.

Hi there, Any progress on this? Would like to launch the site next week

Hi Elvira,
Apologies, I replied directly to the email rather than on this forum so it appears like you did not receive my reply; So…here it is:

Use any product from this page. Ice Cream Sandwiches would be easiest : https://butterandcream.secondplatformdev.com/decatur-order-form/

Here is the System Status info you requested:

{
### WordPress Environment ###

WordPress address (URL): https://butterandcream.secondplatformdev.com
Site address (URL): https://butterandcream.secondplatformdev.com
WC Version: 4.3.1
REST API Version: ? 1.0.10
WC Blocks Version: ? 2.7.2
Action Scheduler Version: ? 3.1.6
WC Admin Version: ? 1.3.1
Log Directory Writable: ?
WP Version: 5.4.2
WP Multisite: –
WP Memory Limit: 1 GB
WP Debug Mode: –
WP Cron: ?
Language: en_US
External object cache: –

### Server Environment ###

Server Info: Apache
PHP Version: 7.3.16
PHP Post Max Size: 128 MB
PHP Time Limit: 300
PHP Max Input Vars: 3000
cURL Version: 7.59.0
OpenSSL/1.0.2r

SUHOSIN Installed: –
MySQL Version: 5.6.40-84.0-log
Max Upload Size: 128 MB
Default Timezone is UTC: ?
fsockopen/cURL: ?
SoapClient: ?
DOMDocument: ?
GZip: ?
Multibyte String: ?
Remote Post: ?
Remote Get: ?

### Database ###

WC Database Version: 4.3.1
WC Database Prefix: wp_
Total Database Size: 39.14MB
Database Data Size: 35.18MB
Database Index Size: 3.96MB
wp_woocommerce_sessions: Data: 0.02MB + Index: 0.02MB + Engine InnoDB
wp_woocommerce_api_keys: Data: 0.02MB + Index: 0.03MB + Engine InnoDB
wp_woocommerce_attribute_taxonomies: Data: 0.02MB + Index: 0.02MB + Engine InnoDB
wp_woocommerce_downloadable_product_permissions: Data: 0.02MB + Index: 0.06MB + Engine InnoDB
wp_woocommerce_order_items: Data: 0.02MB + Index: 0.02MB + Engine InnoDB
wp_woocommerce_order_itemmeta: Data: 0.13MB + Index: 0.03MB + Engine InnoDB
wp_woocommerce_tax_rates: Data: 0.02MB + Index: 0.06MB + Engine InnoDB
wp_woocommerce_tax_rate_locations: Data: 0.02MB + Index: 0.03MB + Engine InnoDB
wp_woocommerce_shipping_zones: Data: 0.02MB + Index: 0.00MB + Engine InnoDB
wp_woocommerce_shipping_zone_locations: Data: 0.02MB + Index: 0.03MB + Engine InnoDB
wp_woocommerce_shipping_zone_methods: Data: 0.02MB + Index: 0.00MB + Engine InnoDB
wp_woocommerce_payment_tokens: Data: 0.02MB + Index: 0.02MB + Engine InnoDB
wp_woocommerce_payment_tokenmeta: Data: 0.02MB + Index: 0.03MB + Engine InnoDB
wp_woocommerce_log: Data: 0.02MB + Index: 0.02MB + Engine InnoDB
wp_actionscheduler_actions: Data: 0.44MB + Index: 0.17MB + Engine InnoDB
wp_actionscheduler_claims: Data: 0.02MB + Index: 0.02MB + Engine InnoDB
wp_actionscheduler_groups: Data: 0.02MB + Index: 0.02MB + Engine InnoDB
wp_actionscheduler_logs: Data: 0.14MB + Index: 0.13MB + Engine InnoDB
wp_admin_columns: Data: 0.02MB + Index: 0.02MB + Engine InnoDB
wp_cartflows_ca_cart_abandonment: Data: 0.02MB + Index: 0.02MB + Engine InnoDB
wp_cartflows_ca_email_history: Data: 0.02MB + Index: 0.03MB + Engine InnoDB
wp_cartflows_ca_email_templates: Data: 0.02MB + Index: 0.00MB + Engine InnoDB
wp_cartflows_ca_email_templates_meta: Data: 0.02MB + Index: 0.02MB + Engine InnoDB
wp_commentmeta: Data: 0.02MB + Index: 0.03MB + Engine InnoDB
wp_comments: Data: 0.02MB + Index: 0.09MB + Engine InnoDB
wp_duplicator_packages: Data: 0.02MB + Index: 0.02MB + Engine InnoDB
wp_gf_draft_submissions: Data: 0.02MB + Index: 0.02MB + Engine InnoDB
wp_gf_entry: Data: 0.02MB + Index: 0.03MB + Engine InnoDB
wp_gf_entry_meta: Data: 0.02MB + Index: 0.05MB + Engine InnoDB
wp_gf_entry_notes: Data: 0.02MB + Index: 0.03MB + Engine InnoDB
wp_gf_form: Data: 0.02MB + Index: 0.00MB + Engine InnoDB
wp_gf_form_meta: Data: 0.02MB + Index: 0.00MB + Engine InnoDB
wp_gf_form_revisions: Data: 0.02MB + Index: 0.03MB + Engine InnoDB
wp_gf_form_view: Data: 0.02MB + Index: 0.03MB + Engine InnoDB
wp_links: Data: 0.02MB + Index: 0.02MB + Engine InnoDB
wp_options: Data: 3.17MB + Index: 0.16MB + Engine InnoDB
wp_postmeta: Data: 11.48MB + Index: 0.80MB + Engine InnoDB
wp_posts: Data: 8.48MB + Index: 0.22MB + Engine InnoDB
wp_rg_form: Data: 0.02MB + Index: 0.00MB + Engine InnoDB
wp_rg_form_meta: Data: 0.02MB + Index: 0.00MB + Engine InnoDB
wp_rg_form_view: Data: 0.02MB + Index: 0.03MB + Engine InnoDB
wp_rg_incomplete_submissions: Data: 0.02MB + Index: 0.02MB + Engine InnoDB
wp_rg_lead: Data: 0.02MB + Index: 0.03MB + Engine InnoDB
wp_rg_lead_detail: Data: 0.02MB + Index: 0.06MB + Engine InnoDB
wp_rg_lead_detail_long: Data: 0.02MB + Index: 0.00MB + Engine InnoDB
wp_rg_lead_meta: Data: 0.02MB + Index: 0.05MB + Engine InnoDB
wp_rg_lead_notes: Data: 0.02MB + Index: 0.03MB + Engine InnoDB
wp_sbi_instagram_feeds_posts: Data: 0.02MB + Index: 0.02MB + Engine InnoDB
wp_sbi_instagram_posts: Data: 0.05MB + Index: 0.00MB + Engine InnoDB
wp_termmeta: Data: 0.02MB + Index: 0.03MB + Engine InnoDB
wp_terms: Data: 0.02MB + Index: 0.03MB + Engine InnoDB
wp_term_relationships: Data: 0.05MB + Index: 0.02MB + Engine InnoDB
wp_term_taxonomy: Data: 0.02MB + Index: 0.03MB + Engine InnoDB
wp_usermeta: Data: 0.06MB + Index: 0.03MB + Engine InnoDB
wp_users: Data: 0.02MB + Index: 0.05MB + Engine InnoDB
wp_wcpdf_invoice_number: Data: 0.02MB + Index: 0.00MB + Engine InnoDB
wp_wc_admin_notes: Data: 0.02MB + Index: 0.00MB + Engine InnoDB
wp_wc_admin_note_actions: Data: 0.02MB + Index: 0.02MB + Engine InnoDB
wp_wc_category_lookup: Data: 0.02MB + Index: 0.00MB + Engine InnoDB
wp_wc_customer_lookup: Data: 0.02MB + Index: 0.03MB + Engine InnoDB
wp_wc_download_log: Data: 0.02MB + Index: 0.03MB + Engine InnoDB
wp_wc_order_coupon_lookup: Data: 0.02MB + Index: 0.03MB + Engine InnoDB
wp_wc_order_product_lookup: Data: 0.02MB + Index: 0.06MB + Engine InnoDB
wp_wc_order_stats: Data: 0.02MB + Index: 0.05MB + Engine InnoDB
wp_wc_order_tax_lookup: Data: 0.02MB + Index: 0.03MB + Engine InnoDB
wp_wc_product_meta_lookup: Data: 0.02MB + Index: 0.09MB + Engine InnoDB
wp_wc_reserved_stock: Data: 0.02MB + Index: 0.00MB + Engine InnoDB
wp_wc_tax_rate_classes: Data: 0.02MB + Index: 0.02MB + Engine InnoDB
wp_wc_webhooks: Data: 0.02MB + Index: 0.02MB + Engine InnoDB
wp_wfBlockedIPLog: Data: 0.02MB + Index: 0.00MB + Engine InnoDB
wp_wfBlocks7: Data: 0.02MB + Index: 0.05MB + Engine InnoDB
wp_wfConfig: Data: 0.52MB + Index: 0.00MB + Engine InnoDB
wp_wfCrawlers: Data: 0.02MB + Index: 0.00MB + Engine InnoDB
wp_wfFileChanges: Data: 0.02MB + Index: 0.00MB + Engine InnoDB
wp_wfFileMods: Data: 5.52MB + Index: 0.00MB + Engine InnoDB
wp_wfHits: Data: 0.34MB + Index: 0.16MB + Engine InnoDB
wp_wfHoover: Data: 0.02MB + Index: 0.02MB + Engine InnoDB
wp_wfIssues: Data: 0.02MB + Index: 0.06MB + Engine InnoDB
wp_wfKnownFileList: Data: 2.52MB + Index: 0.00MB + Engine InnoDB
wp_wfLiveTrafficHuman: Data: 0.02MB + Index: 0.02MB + Engine InnoDB
wp_wfLocs: Data: 0.02MB + Index: 0.00MB + Engine InnoDB
wp_wfLogins: Data: 0.06MB + Index: 0.03MB + Engine InnoDB
wp_wfls_2fa_secrets: Data: 0.02MB + Index: 0.02MB + Engine InnoDB
wp_wfls_settings: Data: 0.02MB + Index: 0.00MB + Engine InnoDB
wp_wfNotifications: Data: 0.02MB + Index: 0.00MB + Engine InnoDB
wp_wfPendingIssues: Data: 0.02MB + Index: 0.06MB + Engine InnoDB
wp_wfReverseCache: Data: 0.02MB + Index: 0.00MB + Engine InnoDB
wp_wfSNIPCache: Data: 0.02MB + Index: 0.05MB + Engine InnoDB
wp_wfStatus: Data: 0.13MB + Index: 0.09MB + Engine InnoDB
wp_wfTrafficRates: Data: 0.02MB + Index: 0.00MB + Engine InnoDB
wp_woocommerce_pickup_locations_geodata: Data: 0.02MB + Index: 0.05MB + Engine InnoDB
wp_woocommerce_square_customers: Data: 0.28MB + Index: 0.00MB + Engine InnoDB
wp_yoast_indexable: Data: 0.19MB + Index: 0.09MB + Engine InnoDB
wp_yoast_indexable_hierarchy: Data: 0.02MB + Index: 0.05MB + Engine InnoDB
wp_yoast_migrations: Data: 0.02MB + Index: 0.02MB + Engine InnoDB
wp_yoast_primary_term: Data: 0.02MB + Index: 0.03MB + Engine InnoDB
wp_yoast_seo_links: Data: 0.02MB + Index: 0.02MB + Engine InnoDB
wp_yoast_seo_meta: Data: 0.02MB + Index: 0.00MB + Engine InnoDB

### Post Type Counts ###

acf-field-group: 1
attachment: 119
cartflows_flow: 1
cartflows_step: 2
custom_css: 1
customize_changeset: 4
elementor_font: 2
elementor_library: 36
et_pb_layout: 33
fdm-menu: 1
global_product_addon: 1
kt_font: 1
nav_menu_item: 18
page: 22
post: 1
product: 31
product_variation: 122
revision: 894
shop_order: 27
wc_pickup_location: 2
wcpa_pt_forms: 9

### Security ###

Secure connection (HTTPS): ?
Hide errors from visitors: ?

### Active Plugins (30) ###

Admin Columns Pro – WooCommerce: by AdminColumns.com – 3.5.1
Admin Columns Pro: by AdminColumns.com – 5.2.1
Akismet Anti-Spam: by Automattic – 4.1.6
Classic Editor: by WordPress Contributors – 1.5
Yoast Duplicate Post: by Enrico Battocchi & Team Yoast – 3.2.5
Duplicator: by Snap Creek – 1.3.36
Ele Custom Skin Pro: by Dudaster.com – 2.1.0
Ele Custom Skin: by Dudaster.com – 2.2.2
Elementor Pro: by Elementor.com – 2.10.3
Elementor: by Elementor.com – 2.9.14
Enable Media Replace: by ShortPixel – 3.4.1
Essential Addons for Elementor – Pro: by WPDeveloper – 4.1.0 – Installed version not tested with active version of WooCommerce 4.3.1
Essential Addons for Elementor: by WPDeveloper – 4.1.0 – Installed version not tested with active version of WooCommerce 4.3.1
Smash Balloon Instagram Feed: by Smash Balloon – 2.4.5
Central Color Palette: by Daniel Menzies – 1.14.7
New Order Notification for Woocommerce: by Mr.Ebabi – 1.2.1
Order Delivery Date Pro for WooCommerce: by Tyche Softwares – 9.18.1
PW WooCommerce Bulk Edit: by Pimwick
LLC – 2.75

Really Simple SSL: by Really Simple Plugins – 3.3.4
UpdraftPlus – Backup/Restore: by UpdraftPlus.Com
DavidAnderson – 2.14.4.22

White Label CMS: by https://www.videousermanuals.com – 2.2.1
Woocommerce Custom Product Addons: by Acowebs – 3.9.5 – Installed version not tested with active version of WooCommerce 4.3.1
WooCommerce PDF Invoices & Packing Slips: by Ewout Fernhout – 2.5.3
WooCommerce Side Cart Premium: by XootiX – 2.4 – Installed version not tested with active version of WooCommerce 4.3.1
WooCommerce Square: by WooCommerce – 2.1.6
WooCommerce: by Automattic – 4.3.1
Woolementor Pro: by Woolementor – 1.4.2
Woolementor: by Woolementor – 1.4.2 – Installed version not tested with active version of WooCommerce 4.3.1
Wordfence Security: by Wordfence – 7.4.9
Yoast SEO: by Team Yoast – 14.6.1

### Inactive Plugins (0) ###

### Settings ###

API Enabled: –
Force SSL: ?
Currency: USD ($)
Currency Position: left
Thousand Separator: ,
Decimal Separator: .
Number of Decimals: 2
Taxonomies: Product Types: external (external)
grouped (grouped)
simple (simple)
variable (variable)

Taxonomies: Product Visibility: exclude-from-catalog (exclude-from-catalog)
exclude-from-search (exclude-from-search)
featured (featured)
outofstock (outofstock)
rated-1 (rated-1)
rated-2 (rated-2)
rated-3 (rated-3)
rated-4 (rated-4)
rated-5 (rated-5)

Connected to WooCommerce.com: –

### WC Pages ###

Shop base: #160 – /flavors-and-desserts/
Cart: ? Page does not contain the shortcode.
Checkout: ? Page does not contain the shortcode.
My account: #607 – /my-account/
Terms and conditions: ? Page not set

### Theme ###

Name: Kadence
Version: 0.7.11
Author URL: https://www.kadencewp.com/
Child Theme: ? – If you are modifying WooCommerce on a parent theme that you did not build personally we recommend using a child theme. See: How to create a child theme
WooCommerce Support: ?

### Templates ###

Overrides: –

### Square ###

Environment: Production
Tokenization Enabled: –
Debug Mode: Off

### Action Scheduler ###

Complete: 538
Oldest: 2020-06-23 08:37:49 -0700
Newest: 2020-07-22 01:02:35 -0700

Pending: 5
Oldest: 2020-07-22 15:56:03 -0700
Newest: 2020-07-28 16:20:55 -0700

`

Hi Shabti,
Thanks for your reply. Currently, when Select User is chosen, the Username form field is populated with the current user and I am unable to type anything into that field. I am using Elementor Pro.

@shabti it was happening with both single and multi yesterday.