// For flags

CVE-2022-4017

Booster for WooCommerce - Multiple CSRF

Severity Score

8.8
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

1
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Track*
*SSVC
Descriptions

The Booster for WooCommerce WordPress plugin before 6.0.1, Booster Plus for WooCommerce WordPress plugin before 6.0.1, Booster Elite for WooCommerce WordPress plugin before 6.0.1 have either flawed CSRF checks or are missing them completely in numerous places, allowing attackers to make logged in users perform unwanted actions via CSRF attacks

Las versiones del complemento Booster para WooCommerce de WordPress anteriores a la versión 6.0.1, así como las versiones anteriores a la 6.0.1 del complemento Booster Plus para WooCommerce y también las anteriores a la 6.0.1 del complemento Booster Elite para WooCommerce tienen comprobaciones CSRF defectuosas o faltan por completo en numerosos lugares, lo que permite a los atacantes engañar a los usuarios registrados para que lleven a cabo acciones no deseadas a través de ataques CSRF.

The Booster plugins (Booster, Booster Plus, and Booster Elite) for WordPress are vulnerable to Cross-Site Request Forgery in versions up to, and including, 6.0.0 (Booster), 6.0.0 (Plus), and 6.0.0 (Elite). This is due to missing or incorrect nonce validation on several functions. This makes it possible for unauthenticated attackers to invoke those functions via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

*Credits: WPScan, WPScan
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
Low
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
Complete
Integrity
Complete
Availability
Complete
* Common Vulnerability Scoring System
SSVC
  • Decision:Track*
Exploitation
None
Automatable
No
Tech. Impact
Total
* Organization's Worst-case Scenario
Timeline
  • 2022-11-16 CVE Reserved
  • 2023-01-02 CVE Published
  • 2025-03-30 EPSS Updated
  • 2025-04-02 CVE Updated
  • 2025-04-02 First Exploit
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-352: Cross-Site Request Forgery (CSRF)
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Booster
Search vendor "Booster"
 Booster Elite Woocommerce
Search vendor "Booster" for product "Booster Elite Woocommerce"
 < 6.0.1
Search vendor "Booster" for product "Booster Elite Woocommerce" and version " < 6.0.1"
wordpress
Affected
Booster
Search vendor "Booster"
 Booster For Woocommerce
Search vendor "Booster" for product "Booster For Woocommerce"
 < 6.0.1
Search vendor "Booster" for product "Booster For Woocommerce" and version " < 6.0.1"
wordpress
Affected
Booster
Search vendor "Booster"
 Booster Plus Woocommerce
Search vendor "Booster" for product "Booster Plus Woocommerce"
 < 6.0.1
Search vendor "Booster" for product "Booster Plus Woocommerce" and version " < 6.0.1"
wordpress
Affected