CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
The Booster for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the validate_product_input_fields_on_add_to_cart function in versions 4.0.1 to 7.2.4. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Explanation of Vulnerability in Simple Terms
Booster for WooCommerce versions 4.0.1 through 7.2.4 allow unauthenticated attackers to upload arbitrary files to the site. The vulnerability requires high attack complexity but no user interaction. Successful exploitation grants an attacker the ability to read sensitive data, modify site content, and disrupt service availability.
What an attacker can do
Upload arbitrary files to the site without authentication, potentially leading to data theft, site modification, or service disruption.
Potential impact on your site
An attacker can upload malicious files, read sensitive data, modify your store, or take the site offline without needing a user account.
Conditions required to exploit
Network access to the site; no authentication or user interaction required, though exploitation requires specific technical conditions.
Key dates
External resources
Related vulnerabilities
