When a user visits the WooCommerce checkout page, the Css_Frontend::print_to_wp_head() function retrieves this stored value and echoes it directly into a <style> block without output escaping. An unauthenticated attacker can leverage this injection point to execute arbitrary JavaScript in the context of the victim's session, potentially leading to session hijacking, credential theft, or unauthorized actions performed on behalf of the site user. The scope of this threat is significant given the plugin's integration into the checkout process, which is a high-value target for attackers.

Impact

Successful exploitation allows unauthenticated attackers to execute arbitrary code in the browser context of any user viewing the WooCommerce checkout page. This can lead to full site administrative compromise if a site administrator views the page, or the theft of customer session cookies and sensitive checkout information. The vulnerability affects all WordPress installations utilizing the Platnosci Online Blue Media plugin up to version 5.0.0.

Recommendation

Prioritized, concrete actions for detection and remediation:

• Update the Platnosci Online Blue Media (Autopay) plugin to the latest available version beyond 5.0.0 immediately.
• Deploy WAF rules to inspect HTTP POST requests for the 'bm_woocommerce_css_editor_content' parameter to detect script-like payloads (e.g., <script>, javascript:, or event handlers).
• Implement access control list (ACL) restrictions at the web server level to limit access to the endpoints responsible for updating settings if the plugin functionality is not strictly required.
• Review web server access logs for anomalous POST requests targeting the WordPress site with the identified parameter.