CVE-2024-13744: Booster for WooCommerce 4.0.1 - 7.2.4 - Unauthenticated Arbitrary File Upload

Q: What is the severity of CVE-2024-13744?

CVE-2024-13744 is considered a high severity vulnerability due to the potential for unauthenticated file uploads.

Q: How do I fix CVE-2024-13744?

To fix CVE-2024-13744, update the Booster for WooCommerce plugin to a version above 7.2.4.

Q: What versions of Booster for WooCommerce are affected by CVE-2024-13744?

CVE-2024-13744 affects versions of Booster for WooCommerce from 4.0.1 to 7.2.4.

Q: Who can exploit CVE-2024-13744?

CVE-2024-13744 can be exploited by unauthenticated attackers to upload arbitrary files.

Q: What kind of attack does CVE-2024-13744 enable?

CVE-2024-13744 enables attacks involving arbitrary file uploads, which can compromise the WordPress site.

Published Apr 4, 2025

Updated

The Booster for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the validateproductinputfieldsonaddtocart function in versions 4.0.1 to 7.2.4. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.

Affected Software

2 affected components

Booster for WooCommerce Booster for WooCommerce>=4.0.1<=7.2.4

Booster Booster for WooCommerce WordPress>=4.0.1<7.2.5

Remediation

Patch Available

https://plugins.trac.wordpress.org/changeset/3262569/woocommerce-jetpack/trunk/includes/input-fields/class-wcj-product-input-fields-core.php

Event History

Apr 4, 2025

CVE Published

via MITRE·04:21 AM

Data Sourced

via MITRE·04:21 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·05:15 AM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2024-13744?

CVE-2024-13744 is considered a high severity vulnerability due to the potential for unauthenticated file uploads.

How do I fix CVE-2024-13744?