CVE-2023-25996: WordPress Booster Elite for WooCommerce plugin < 8.4.0 - Authenticated Arbitrary WordPress Option Disclosure vulnerability

Q: Who can exploit this issue?

An attacker needs authenticated access with low privileges (PR:L). The network attack vector and lack of required user interaction mean the attacker can exploit it remotely once authenticated.

Q: What information could be exposed?

The vulnerability allows disclosure of arbitrary WordPress option data and embedded sensitive information sent by the affected plugin. The confidentiality impact is rated high; no integrity or availability impact is identified.

Q: Which versions are affected?

Booster Elite for WooCommerce versions before 8.4.0 are affected. Upgrade to version 8.4.0 or later.

Published Oct 12, 2026

Updated

Insertion of Sensitive Information Into Sent Data vulnerability in Pluggabl LLC. Booster Elite for WooCommerce booster-elite-for-woocommerce allows Retrieve Embedded Sensitive Data.This issue affects Booster Elite for WooCommerce: from n/a before 8.4.0.

Affected Software

1 affected component

Pluggabl LLC Booster Elite for WooCommerce<8.4.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade booster-elite-for-woocommerce to a version that resolves this vulnerability.
Fixed in 8.4.0

Event History

Oct 12, 2026

CVE Published

via MITRE·08:15 AM

Data Sourced

via MITRE·08:15 AM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker needs authenticated access with low privileges (PR:L). The network attack vector and lack of required user interaction mean the attacker can exploit it remotely once authenticated.

What information could be exposed?