CVE-2022-4017

Booster for WooCommerce - Multiple CSRF

Severity Score

8.8

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

The Booster for WooCommerce WordPress plugin before 6.0.1, Booster Plus for WooCommerce WordPress plugin before 6.0.1, Booster Elite for WooCommerce WordPress plugin before 6.0.1 have either flawed CSRF checks or are missing them completely in numerous places, allowing attackers to make logged in users perform unwanted actions via CSRF attacks

Las versiones del complemento Booster para WooCommerce de WordPress anteriores a la versión 6.0.1, así como las versiones anteriores a la 6.0.1 del complemento Booster Plus para WooCommerce y también las anteriores a la 6.0.1 del complemento Booster Elite para WooCommerce tienen comprobaciones CSRF defectuosas o faltan por completo en numerosos lugares, lo que permite a los atacantes engañar a los usuarios registrados para que lleven a cabo acciones no deseadas a través de ataques CSRF.

The Booster plugins (Booster, Booster Plus, and Booster Elite) for WordPress are vulnerable to Cross-Site Request Forgery in versions up to, and including, 6.0.0 (Booster), 6.0.0 (Plus), and 6.0.0 (Elite). This is due to missing or incorrect nonce validation on several functions. This makes it possible for unauthenticated attackers to invoke those functions via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

*Credits: WPScan, WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2022-11-16 CVE Reserved
2023-01-02 CVE Published
2024-08-03 CVE Updated
2024-08-03 First Exploit
2024-08-15 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date

CWE

CWE-352: Cross-Site Request Forgery (CSRF)

CAPEC

References (1)

URL	Tag	Source

URL	Date	SRC
https://wpscan.com/vulnerability/609072d0-9bb9-4fe0-9626-7e4a334ca3a4	2024-08-03

URL	Date	SRC

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Booster Search vendor "Booster"		Booster Elite Woocommerce Search vendor "Booster" for product "Booster Elite Woocommerce"				< 6.0.1 Search vendor "Booster" for product "Booster Elite Woocommerce" and version " < 6.0.1"		wordpress		Affected
Booster Search vendor "Booster"		Booster For Woocommerce Search vendor "Booster" for product "Booster For Woocommerce"				< 6.0.1 Search vendor "Booster" for product "Booster For Woocommerce" and version " < 6.0.1"		wordpress		Affected
Booster Search vendor "Booster"		Booster Plus Woocommerce Search vendor "Booster" for product "Booster Plus Woocommerce"				< 6.0.1 Search vendor "Booster" for product "Booster Plus Woocommerce" and version " < 6.0.1"		wordpress		Affected