CVE-2024-13744

HIGH

Booster for WooCommerce 4.0.1 - 7.2.4 - Unauthenticated Arbitrary File Upload

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2024-13744 has a selected CVSS score of 8.1 (high).

Description

The Booster for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the validate_product_input_fields_on_add_to_cart function in versions 4.0.1 to 7.2.4. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · May 4, 2026 · VulnCheck
Reported exploitation
Observed · VulnCheck

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Apr 4, 2025 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

booster_for_woocommerce

Browse booster / booster_for_woocommerce
VulnCheckVersion data not supplied

Booster for WooCommerce

Browse pluggabl / Booster for WooCommerce

Default status: unaffected

CVE List4.0.1 to ≤ 7.2.4affected

References

3