CVSS 3.1
7.3 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:LCVE-2024-3957
High (7.3) in booster booster for woocommerce. EPSS 0.9% chance of exploitation in the next 30 days.
The Booster for WooCommerce plugin is vulnerable to Unauthenticated Arbitrary Shortcode Execution in versions up to, and including, 7.1.8. This allows unauthenticated attackers to execute arbitrary shortcodes. The severity and exploitability depends on what other plugins are installed and what shortcode functionality they provide.
Severity
- EPSS
- 0.9% chance of exploitation in the next 30 days; higher than 59% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-94, CWE-863
- Published
- Modified
- Record from
- the NVD, synced
Affected
- booster:booster_for_woocommerce
References
- https://plugins.trac.wordpress.org/browser/woocommerce-jetpack/trunk/includes/class-wcj-product-by-user.php#L245
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3076207%40woocommerce-jetpack%2Ftrunk&old=3046146%40woocommerce-jetpack%2Ftrunk&sfp_email=&sfph_mail=#file7
- https://www.wordfence.com/threat-intel/vulnerabilities/id/1653de8f-62eb-488b-9e97-8b30221b509f?source=cve
- https://plugins.trac.wordpress.org/browser/woocommerce-jetpack/trunk/includes/class-wcj-product-by-user.php#L245
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3076207%40woocommerce-jetpack%2Ftrunk&old=3046146%40woocommerce-jetpack%2Ftrunk&sfp_email=&sfph_mail=#file7