Description

WordPress Plugin Booster for WooCommerce is prone to multiple vulnerabilities, including directory traversal and cross-site request forgery vulnerabilities. Exploiting these issues may allow an attacker to obtain sensitive information that could aid in further attacks, or to perform certain administrative actions and gain unauthorized access to the affected application. WordPress Plugin Booster for WooCommerce version 5.6.6 is vulnerable; prior versions may also be affected.

Remediation

Update to plugin version 5.6.7 or latest

References

https://sploitus.com/exploit?id=WPEX-ID:96EF4BB8-A054-48AE-B29C-B3060ACD01AC

https://sploitus.com/exploit?id=WPEX-ID:7AB15530-8321-487D-97A5-1469B51FCC3F

https://sploitus.com/exploit?id=WPEX-ID:9B77044C-FD3F-4E6F-A759-DCC3082DCBD6

https://wpscan.com/vulnerability/d6c21a5a-a7ce-4914-9b69-72780dba4225

https://plugins.svn.wordpress.org/woocommerce-jetpack/trunk/readme.txt

Related Vulnerabilities

Piwigo Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2017-5608)

IBM RTC Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2016-2926)

MySQL CVE-2012-3163 Vulnerability (CVE-2012-3163)

WordPress Plugin Circles Gallery Cross-Site Scripting (1.0.10)

WordPress Plugin Formidable Forms-Contact Form, Survey, Quiz, Calculator & Custom Form Builder Unspecified Vulnerability (5.0.12)

Severity

High

Classification

CVE-2022-3762 CVE-2022-3763 CVE-2022-4016 CVE-2022-41805 CWE-22 CWE-352 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Tags

Missing Update