Nonce verification failed woocommerce on Add to Basket

There is also now a Critical warning about a security issue with it, so I hope anyone who has WordFence will also contact them to fix that, and the other problem it is causing.

Hi

Same issue for me, add to basket failed on production website after update to 3.0.7 but I discovered it after 3.0.8 update when a customer reported me the issue, it was working fine on some product categories and not on some other ones.

I had to rollback the plugin to 3.0.6 to have it working again and disabled the auto update

Can you please fix this issue?

Best Regards

If you have WordFence installed, it might throw a warning about the security of that version.

After disabling this plugin, to get rid of the Add to Basket issue, WF reported a security issue with it.

I did report it on here, but that report was removed for some reason.

I don’t have a security plugin at wordpress level, and it worked for some product categories and not the other ones.

I have tried disabling everything then put each plugin back one by one and Extra Product Options was the only one creating the issue.

I had some product categories without additional fields, I added a “Free comments” field to ensure every category had one and it solved the “add to basked” issue in 3.0.7 directly from the product page but not from the “store” page which was still failing with the nonce message.

When I rollbacked this plugin to 3.0.6 it works from the product page and store page

Using Older plugins is also frowned upon, specially with security in mind.

We will leave it disabled until a fix is found for it. Darent roll back to an old version that is “pre” security critical” from WordFence… too risky in my mind.

Encountering same issue here. Please release a bug fix. Thank you!

hi, i have the same issue since 4 days

please can help me to fix this problem ?

Thank you for adding to this thread.
So far, no response from the developer of this plugin.
We may even post on our website’s blog about this issue at some point.
We did raise this in the “Report this topic for” section on this page, but it was withdrawn for some reason.
WordFence reports this current version to have a security issue.

Same here,

Do we know of there will be an update?

I have the same problem. Can someone provide me the working version (5.0.6)

Hi.

We have develop a patch for this. On includes/class-epofw-front.php file, function epofw_add_cart_item_data, change:

if ( empty( $_POST ) ) {
return false;
}

To:

if ( empty( $_POST ) || ! empty( $product_id ) || isset( $_POST['epfow_addon_field_nonce_' . $product_id] ) ) {
return false;
}

With this change the function only continues their execution when a nonce field is set, and this only happens when the product has established options.

I hope it will be helpful.

Hi,

You need to add this hook in functions.php

add_action('woocommerce_after_add_to_cart_button', 'woocommerce_after_add_to_cart_button_epofw_nonce', 10);
function woocommerce_after_add_to_cart_button_epofw_nonce(){
if ( class_exists( 'EPOFW_Front' ) ) {
global $post;
$epofw = new EPOFW_Front;
$main_fields_data_arr = $epofw->epofw_get_fields_data( $post->ID );
    if ( empty( $main_fields_data_arr ) ) {
        wp_nonce_field( 'epfow_addon_field_nonce_' . $post->ID );
    }
}
}