CVE-2023-48747 WordPress Booster for WooCommerce plugin <= 7.1.2 - Authenticated Production Creation/Modification Vulnerability

2024-06-0410:58:26

CWE-287

Patchstack

www.cve.org

cve-2023-48747

improper authentication

pluggabl llc booster

functionality access

acls constrained

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

EPSS

Percentile

9.0%

JSON

Improper Authentication vulnerability in Pluggabl LLC Booster for WooCommerce allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Booster for WooCommerce: from n/a through 7.1.2.

CNA Affected

[
  {
    "collectionURL": "https://wordpress.org/plugins",
    "defaultStatus": "unaffected",
    "packageName": "woocommerce-jetpack",
    "product": "Booster for WooCommerce",
    "vendor": "Pluggabl LLC",
    "versions": [
      {
        "changes": [
          {
            "at": "7.1.3",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "7.1.2",
        "status": "affected",
        "version": "n/a",
        "versionType": "custom"
      }
    ]
  }
]

References

patchstack.com/database/vulnerability/woocommerce-jetpack/wordpress-booster-for-woocommerce-plugin-7-1-2-authenticated-production-creation-modification-vulnerability?_s_id=cve