Changeset 3772665

Timestamp:

10/29/2026 10:44:25 AM (6 hours ago)

Author:

ithemelandco

Message:

4.6
Security: Fixed an unauthenticated arbitrary shortcode execution vulnerability in the gift popup AJAX handler.
Security: Restricted gift layouts to supported values and improved shortcode attribute validation and escaping.
Credits: Thanks to Nguyen Quang Tan and Patchstack for responsibly reporting this vulnerability.

Location:

ithemeland-free-gifts-for-woo/trunk

Files:

• frontend/classes/shortcodes.php (modified) (5 diffs)
• ithemeland-free-gifts-for-woo.php (modified) (2 diffs)
• readme.txt (modified) (2 diffs)

ithemeland-free-gifts-for-woo/trunk/frontend/classes/shortcodes.php

@@ -161 +161 @@
         );
 
+        $atts_shortcode['type'] = $this->normalize_gift_layout($atts_shortcode['type']);
+
         $flag = true;
         $gift_items = $this->check_rule_condition->pw_get_gift_for_cart_checkout();
@@ -197 +199 @@
         }
 
-        echo wp_kses('<span class="itg-shortoces-products" data-type="' . $atts['type'] . '"  >', Sanitizer::allowed_html());
+        echo wp_kses('<span class="itg-shortoces-products" data-type="' . esc_attr($atts_shortcode['type']) . '"  >', Sanitizer::allowed_html());
 
         if ($flag) {
@@ -212 +214 @@
             $rule_products = [
                 'data_args' => itfreegift_get_gift_products_data_multilevel($args_data),
-                'template' => $atts['type']
+                'template' => $atts_shortcode['type']
             ];
 
@@ -221 +223 @@
     }
 
+    /**
+     * Only registered gift layouts may reach template selection.
+     */
+    private function normalize_gift_layout($type)
+    {
+        $type = is_string($type) ? sanitize_key($type) : '';
+        return in_array($type, ['carousel', 'grid', 'datatable', 'dropdown'], true) ? $type : 'dropdown';
+    }
+
     public function shortcode_show_popup()
     {
-        $type = sanitize_text_field(wp_unslash($_POST['type'])); //phpcs:ignore
-        echo do_shortcode('[itg_gift_products type="' . $type . '"]');
+        $raw_type = isset($_POST['type']) && is_string($_POST['type']) ? wp_unslash($_POST['type']) : '';
+        $type = $this->normalize_gift_layout($raw_type);
+        // Invoke our renderer directly; never parse request input as shortcode source.
+        $this->shortcode_gift_products(['type' => $type], '');
         wp_die();
     }
@@ -235 +248 @@
         check_ajax_referer('jkhKJSdd4576d234Z', 'itg_security');
 
-        $type = isset($_POST['type']) ? sanitize_key(wp_unslash($_POST['type'])) : 'dropdown'; //phpcs:ignore
-        if (!in_array($type, ['carousel', 'grid', 'datatable', 'dropdown'], true)) {
-            $type = 'dropdown';
-        }
+        $raw_type = isset($_POST['type']) && is_string($_POST['type']) ? wp_unslash($_POST['type']) : '';
+        $type = $this->normalize_gift_layout($raw_type);
 
         $this->rendering_checkout = true;
-        echo do_shortcode('[itg_gift_products type="' . $type . '"]');
+        $this->shortcode_gift_products(['type' => $type], '');
         $this->rendering_checkout = false;
         wp_die();

ithemeland-free-gifts-for-woo/trunk/ithemeland-free-gifts-for-woo.php

@@ -5 +5 @@
         Description: Free Gifts for WooCommerce allows you to offer Free Gifts to your customers whenever they make a purchase on your site.
         Author: iThemelandco
-        Version: 4.5
+        Version: 4.6
         Tags: woocommerce,woocommerce gift
         Text Domain: ithemeland-free-gifts-for-woo
@@ -55 +55 @@
 //define('WGBL_WP_TESTED', '6.6');
 define('WGBL_WP_REQUIRE', '5.0.0');
-define('WGBL_VERSION', '4.5');
+define('WGBL_VERSION', '4.6');
 
 register_activation_hook(__FILE__, ['ITFreeGift\classes\bootstrap\WGBL', 'activate']);

ithemeland-free-gifts-for-woo/trunk/readme.txt

@@ -5 +5 @@
 Requires at least: 5.0
 Tested up to: 7.1
-Stable tag: 4.5
+Stable tag: 4.6
 Requires PHP: 7.0
 License: GPLv2 or later
@@ -609 +609 @@
 
 == Changelog ==
+4.6
+* Security: Fixed an unauthenticated arbitrary shortcode execution vulnerability in the gift popup AJAX handler.
+* Security: Restricted gift layouts to supported values and improved shortcode attribute validation and escaping.
+Credits: Thanks to Nguyen Quang Tan and Patchstack for responsibly reporting this vulnerability.
 = 4.5 =
 * Fixed: Duplicate gift additions caused by repeated clicks, overlapping requests, or slow AJAX responses.