CVE-2022-3762: Booster for WooCommerce - ShopManager+ Arbitrary File Download
The Booster for WooCommerce WordPress plugin before 5.6.7, Booster Plus for WooCommerce WordPress plugin before 5.6.5, Booster Elite for WooCommerce WordPress plugin before 1.1.7 do not validate files to download in some of its modules, which could allow ShopManager and Admin to download arbitrary files from the server even when they are not supposed to be able to (for example in multisite)
Affected Software
Event History
Frequently Asked Questions
What is CVE-2022-3762?
CVE-2022-3762 is a vulnerability found in the Booster for WooCommerce WordPress plugin before version 5.6.7, Booster Plus for WooCommerce WordPress plugin before version 5.6.5, and Booster Elite for WooCommerce WordPress plugin before version 1.1.7.
How does CVE-2022-3762 affect my website?
CVE-2022-3762 allows ShopManager and Admin to download arbitrary files in some of the modules of the affected plugins.
What is the severity of CVE-2022-3762?
CVE-2022-3762 has a severity rating of 6.5 (Medium).
Which versions of the affected plugins are vulnerable to CVE-2022-3762?
Versions of Booster for WooCommerce WordPress plugin up to 5.6.7, Booster Plus for WooCommerce WordPress plugin up to 5.6.5, and Booster Elite for WooCommerce WordPress plugin up to 1.1.7 are vulnerable to CVE-2022-3762.
How can I fix CVE-2022-3762?
To fix CVE-2022-3762, update the Booster for WooCommerce WordPress plugin to version 5.6.7, Booster Plus for WooCommerce WordPress plugin to version 5.6.5, and Booster Elite for WooCommerce WordPress plugin to version 1.1.7.