nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2024-3957 CVE-2024-3957
MEDIUM
Booster for WooCommerce <= 7.1.8 - Unauthenticated Arbitrary Shortcode Execution
Record summary
CVE-2024-3957 has a selected CVSS score of 6.5 (medium).
Description
The Booster for WooCommerce plugin is vulnerable to Unauthenticated Arbitrary Shortcode Execution in versions up to, and including, 7.1.8. This allows unauthenticated attackers to execute arbitrary shortcodes. The severity and exploitability depends on what other plugins are installed and what shortcode functionality they provide.
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationNone
AutomatableYes
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Jul 5, 2024 · Source: CVE List
Affected products and versions
2| Product | Source | Version range | Status |
|---|---|---|---|
booster_for_woocommerceBrowse booster / booster_for_woocommerceDefault status: unaffected | CVE List | Through 7.1.8 | affected |
Booster for WooCommerce – PDF Invoices, Abandoned Cart, Variation Swatches & 100+ ToolsBrowse pluggabl / Booster for WooCommerce – PDF Invoices, Abandoned Cart, Variation Swatches & 100+ ToolsDefault status: unaffected | CVE List | Through 7.1.8 | affected |
References
4plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/woocommerce-jetpack/trunk/includes/class-wcj-product-by-user.php plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3076207%40woocommerce-jetpack%2Ftrunk&old=3046146%40woocommerce-jetpack%2Ftrunk&sfp_email=&sfph_mail= wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/1653de8f-62eb-488b-9e97-8b30221b509f?source=cve