Description

WordPress Plugin Booster for WooCommerce is prone to multiple vulnerabilities, including directory traversal and cross-site request forgery vulnerabilities. Exploiting these issues may allow an attacker to obtain sensitive information that could aid in further attacks, or to perform certain administrative actions and gain unauthorized access to the affected application. WordPress Plugin Booster for WooCommerce version 5.6.6 is vulnerable; prior versions may also be affected.

Remediation

Update to plugin version 5.6.7 or latest

References

https://sploitus.com/exploit?id=WPEX-ID:96EF4BB8-A054-48AE-B29C-B3060ACD01AC

https://sploitus.com/exploit?id=WPEX-ID:7AB15530-8321-487D-97A5-1469B51FCC3F

https://sploitus.com/exploit?id=WPEX-ID:9B77044C-FD3F-4E6F-A759-DCC3082DCBD6

https://wpscan.com/vulnerability/d6c21a5a-a7ce-4914-9b69-72780dba4225

https://plugins.svn.wordpress.org/woocommerce-jetpack/trunk/readme.txt

Related Vulnerabilities

WordPress Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2012-2404)

MySQL CVE-2018-2696 Vulnerability (CVE-2018-2696)

WordPress Plugin Safe SVG Denial of Service (1.9.4)

Joomla! Core 3.x.x Cross-Site Scripting (3.0.0 - 3.1.5)

MediaWiki Insertion of Sensitive Information into Log File Vulnerability (CVE-2024-40596)

Severity

High

Classification

CVE-2022-3762 CVE-2022-3763 CVE-2022-4016 CVE-2022-41805 CWE-22 CWE-352 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Tags

Missing Update