Attack Chain

1. An attacker identifies a publicly accessible order placement or profile update page that utilizes the vulnerable EU VAT Assistant plugin.
2. The attacker crafts a malicious JavaScript payload designed to perform unauthorized administrative actions, such as 'wp-admin/user-new.php' requests.
3. The attacker submits the order or profile information, injecting the JavaScript payload into the 'vat_number' parameter.
4. The application fails to sanitize or escape the input, storing the malicious script directly into the WordPress database.
5. A legitimate administrator navigates to the WooCommerce Orders section to review the transaction.
6. The browser renders the stored script while the administrator views the 'Edit Order' screen.
7. The script executes with the administrator's session privileges, allowing the attacker to create a new administrative user or modify system settings.
8. The attacker authenticates as the newly created administrative user to gain persistent access.

Impact

Successful exploitation allows unauthenticated attackers to execute arbitrary JavaScript in the context of an administrator's session. This leads to full site compromise, including the ability to exfiltrate sensitive data, inject unauthorized content, or create persistent administrative backdoors. Given the ubiquity of WooCommerce installations, the potential victim base is significant.

Recommendation

Prioritized actions for security teams:

• Update The EU VAT Assistant for WooCommerce plugin to the latest version immediately following vendor guidance.
• Review WordPress audit logs for unexpected administrative account creation or changes to user roles.
• Implement a Content Security Policy (CSP) to restrict the execution of inline scripts and unauthorized external resources on the administrative dashboard.
• Audit administrative access to the WooCommerce backend, specifically monitoring for unusual 'wp-admin' traffic originating from external sources or suspicious browser agents.