CVE-2023-52231 MEDIUM

CVE-2023-52231: WordPress Booster Plus for WooCommerce plugin < 7.1.2 - Auth. Sensitive Data Exposure vulnerability

Vendor Booster
Product Booster Plus for WooCommerce
Weakness CWE-200 · Info exposure
Published March 28, 2024
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

6.5/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

What the vulnerability does

01Description

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Booster Booster Plus for WooCommerce.This issue affects Booster Plus for WooCommerce: from n/a before 7.1.2.

Explanation of Vulnerability in Simple Terms

02Summary

Booster Plus for WooCommerce versions before 7.1.2 expose sensitive information to authenticated users. A logged-in user with low privileges can read data they should not have access to through the plugin's functionality. The vulnerability does not allow data modification or system unavailability. Update to version 7.1.2 or later to resolve this issue.

What an attacker can do

03Attacker Capabilities

Read sensitive information accessible only to higher-privileged users or other site users.

Potential impact on your site

04Site Impact

Customer data, order details, or other sensitive information may be visible to low-privilege users who should not access it.

Conditions required to exploit

05Prerequisites

Attacker must be logged in to the site with a low-privilege account (e.g., subscriber or customer).

Key dates

06Disclosure timeline

March 28, 2024 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-7626 Slek Gateway for WooCommerce <= 1.0 - Unauthenticated Insufficiently Protected Credentials via Payment Redirect Form Hidden Fields CVE-2026-2268 Ninja Forms <= 3.14.0 - Unauthenticated Information Disclosure in nf_ajax_submit AJAX Action CVE-2025-15508 Magic Import Document Extractor <= 1.0.6 - Unauthenticated Sensitive Information Exposure CVE-2025-13371 Money Space <= 2.13.9 - Unauthenticated Sensitive Information Exposure CVE-2026-1307 Ninja Forms <= 3.14.1 - Authenticated (Contributor+) Sensitive Information Disclosure via Block Editor Token