CVE-2023-4796: Booster for WooCommerce <= 7.1.0 - Authenticated (Subscriber+) Information Disclosure via Shortcode
The Booster for WooCommerce for WordPress is vulnerable to Information Disclosure via the 'wcjwpoption' shortcode in versions up to, and including, 7.1.0 due to insufficient controls on the information retrievable via the shortcode. This makes it possible for authenticated attackers, with subscriber-level capabilities or above, to retrieve arbitrary sensitive site options.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2023-4796?
CVE-2023-4796 is a vulnerability in the Booster for WooCommerce for WordPress plugin that allows authenticated attackers to disclose sensitive information.
How severe is CVE-2023-4796?
CVE-2023-4796 has a severity rating of 4.3, which is considered medium.
What is the affected software of CVE-2023-4796?
The affected software of CVE-2023-4796 is Booster for WooCommerce for WordPress versions up to and including 7.1.0.
How can an attacker exploit CVE-2023-4796?
An attacker can exploit CVE-2023-4796 by using the 'wcj_wp_option' shortcode to retrieve sensitive information.
Is there a fix for CVE-2023-4796?
Yes, the fix for CVE-2023-4796 is to update to version 7.1.1 or later of the Booster for WooCommerce for WordPress plugin.