CVE-2024-3957: Code Injection
First published: Thu May 02 2024(Updated: )
The Booster for WooCommerce plugin is vulnerable to Unauthenticated Arbitrary Shortcode Execution in versions up to, and including, 7.1.8. This allows unauthenticated attackers to execute arbitrary shortcodes. The severity and exploitability depends on what other plugins are installed and what shortcode functionality they provide.
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Booster for WooCommerce | <7.1.9 | |
| Booster for WooCommerce | <=7.1.8 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.wordfence.com/threat-intel/vulnerabilities/id/1653de8f-62eb-488b-9e97-8b30221b509f?source=cve
- https://plugins.trac.wordpress.org/browser/woocommerce-jetpack/trunk/includes/class-wcj-product-by-user.php#L245
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3076207%40woocommerce-jetpack%2Ftrunk&old=3046146%40woocommerce-jetpack%2Ftrunk&sfp_email=&sfph_mail=#file7
Frequently Asked Questions
What is the severity of CVE-2024-3957?
CVE-2024-3957 is classified with a severity that varies based on the plugins installed alongside Booster for WooCommerce.
How do I fix CVE-2024-3957?
To fix CVE-2024-3957, upgrade the Booster for WooCommerce plugin to version 7.1.9 or later.
Who is affected by CVE-2024-3957?
Anyone using Booster for WooCommerce versions up to and including 7.1.8 is affected by CVE-2024-3957.
What can an attacker do with CVE-2024-3957?
An attacker exploiting CVE-2024-3957 can execute arbitrary shortcodes without authentication.
Is there a known exploit for CVE-2024-3957?
The exploitability of CVE-2024-3957 depends on the specific setup and configuration of other plugins in use.
- agent/references
- agent/description
- agent/type
- agent/first-publish-date
- agent/author
- collector/epss-latest
- source/FIRST
- agent/epss
- collector/mitre-cve
- source/MITRE
- agent/source
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/severity
- agent/remedy
- agent/last-modified-date
- agent/weakness
- agent/softwarecombine
- agent/guess-ai
- agent/software-canonical-lookup-request
- agent/tags
- agent/event
- vendor/booster
- canonical/booster for woocommerce