PT-2024-28534 · Woocommerce · Booster For Woocommerce

Matthew Rollings + 1 · Published 2024-05-02 · Updated 2025-02-03 · CVE-2024-3957

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions The Booster for WooCommerce plugin versions up to, and including, 7.1.8

Description The issue allows unauthenticated attackers to execute arbitrary shortcodes. The severity and exploitability of this issue depend on what other plugins are installed and the shortcode functionality they provide.

Recommendations For versions up to, and including, 7.1.8, update to a version later than 7.1.8 to resolve the issue. As a temporary workaround, consider restricting access to shortcode functionality to minimize the risk of exploitation.

Fix

Incorrect Authorization

Code Injection

Weakness Enumeration

CWE-863

CWE-94

Related Identifiers

CVE-2024-3957

Affected Products

Booster For Woocommerce

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2024-3957 · Security Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3076207%40woocommerce-jetpack%2Ftrunk&old=3046146%40woocommerce-jetpack%2Ftrunk&sfp_email=&sfph_mail=#file7 · Patch
• https://osv.dev/vulnerability/CVE-2024-3957 · Vendor Advisory
• https://twitter.com/CVEnew/status/1789348988665098573 · Twitter Post
• https://plugins.trac.wordpress.org/browser/woocommerce-jetpack/trunk/includes/class-wcj-product-by-user.php#L245 · Note
• https://twitter.com/VulmonFeeds/status/1786113574345101565 · Twitter Post
• https://t.me/cvenotify/109723 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/1653de8f-62eb-488b-9e97-8b30221b509f?source=cve · Note