Booster Plus for WooCommerce < 7.1.3 - Missing Authorization to Arbitrary Options Disclosure

2024-01-1200:00:00

wpscan.com

wordpress

woocommerce

vulnerability

unauthorized access

capability check

data disclosure

6.3 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

JSON

Description The Booster Plus for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on an unknown function in all versions up to 7.1.3 (exclusive). This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve arbitrary WordPress option values.