Description

WordPress Plugin Booster for WooCommerce is prone to multiple vulnerabilities, including directory traversal and cross-site request forgery vulnerabilities. Exploiting these issues may allow an attacker to obtain sensitive information that could aid in further attacks, or to perform certain administrative actions and gain unauthorized access to the affected application. WordPress Plugin Booster for WooCommerce version 5.6.6 is vulnerable; prior versions may also be affected.

Remediation

Update to plugin version 5.6.7 or latest

References

https://sploitus.com/exploit?id=WPEX-ID:96EF4BB8-A054-48AE-B29C-B3060ACD01AC

https://sploitus.com/exploit?id=WPEX-ID:7AB15530-8321-487D-97A5-1469B51FCC3F

https://sploitus.com/exploit?id=WPEX-ID:9B77044C-FD3F-4E6F-A759-DCC3082DCBD6

https://wpscan.com/vulnerability/d6c21a5a-a7ce-4914-9b69-72780dba4225

https://plugins.svn.wordpress.org/woocommerce-jetpack/trunk/readme.txt

Related Vulnerabilities

Oracle Application Server Other Vulnerability (CVE-2004-1707)

WordPress Plugin WP-Live Chat by 3CX Information Disclosure (8.0.28)

WebLogic CVE-2020-2828 Vulnerability (CVE-2020-2828)

XOOPS Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Vulnerability (CVE-2008-6884)

ownCloud Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2013-0300)

Severity

High

Classification

CVE-2022-3762 CVE-2022-3763 CVE-2022-4016 CVE-2022-41805 CWE-22 CWE-352 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Tags

Missing Update