CVE-2024-13342: Booster for WooCommerce <= 7.2.4 - Unauthenticated Double Extension Arbitrary File Upload
The Booster for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'addfilestoorder' function in all versions up to, and including, 7.2.4. This makes it possible for unauthenticated attackers to upload arbitrary files with double extensions on the affected site's server which may make remote code execution possible. This is only exploitable on select instances where the configuration will execute the first extension present.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2024-13342?
CVE-2024-13342 is considered a high severity vulnerability due to the potential for unauthorized file uploads by attackers.
How do I fix CVE-2024-13342?
To fix CVE-2024-13342, update the Booster for WooCommerce plugin to version 7.2.5 or later.
What versions of Booster for WooCommerce are affected by CVE-2024-13342?
All versions of the Booster for WooCommerce plugin up to and including 7.2.4 are affected by CVE-2024-13342.
Can CVE-2024-13342 be exploited by authenticated users?
CVE-2024-13342 can be exploited by unauthenticated users, making it particularly dangerous.
What type of attack does CVE-2024-13342 enable?
CVE-2024-13342 allows attackers to perform arbitrary file uploads, potentially leading to further exploitation of the site.