Lucene search

WordfenceCVE-2024-3957

HistoryMay 02, 2024 - 5:15 p.m.

CVE-2024-3957

2024-05-0217:15:32

Wordfence

web.nvd.nist.gov

booster for woocommerce

plugin vulnerability

shortcode execution

unauthenticated

nvd

exploitability

arbitrary

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

AI Score

9.7

Confidence

High

EPSS

0.001

Percentile

20.6%

JSON

The Booster for WooCommerce plugin is vulnerable to Unauthenticated Arbitrary Shortcode Execution in versions up to, and including, 7.1.8. This allows unauthenticated attackers to execute arbitrary shortcodes. The severity and exploitability depends on what other plugins are installed and what shortcode functionality they provide.

Affected configurations

Vulners

Vulnrichment

Node

pluggablbooster_for_woocommerceRange≤7.1.8wordpress

VendorProductVersionCPE
pluggablbooster_for_woocommerce*cpe:2.3:a:pluggabl:booster_for_woocommerce:*:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
pluggabl	booster_for_woocommerce	*	cpe:2.3:a:pluggabl:booster_for_woocommerce::::::wordpress::*

CNA Affected

[
  {
    "vendor": "pluggabl",
    "product": "Booster for WooCommerce",
    "versions": [
      {
        "version": "*",
        "status": "affected",
        "lessThanOrEqual": "7.1.8",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

References

plugins.trac.wordpress.org/browser/woocommerce-jetpack/trunk/includes/class-wcj-product-by-user.php#L245

plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3076207%40woocommerce-jetpack%2Ftrunk&old=3046146%40woocommerce-jetpack%2Ftrunk&sfp_email=&sfph_mail=#file7

www.wordfence.com/threat-intel/vulnerabilities/id/1653de8f-62eb-488b-9e97-8b30221b509f?source=cve

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

AI Score

9.7

Confidence

High

EPSS

0.001

Percentile

20.6%

JSON

Related for CVE-2024-3957