CVE-2022-3763

Booster for WooCommerce - Checkout Files Deletion via CSRF

High · published November 21, 2022

CVSS v3.1
8.1
EPSS
0%
Percentile
32.3
In the wild
Unconfirmed
What it is

The Booster for WooCommerce WordPress plugin before 5.6.7, Booster Plus for WooCommerce WordPress plugin before 5.6.5, Booster Elite for WooCommerce WordPress plugin before 1.1.7 do not have CSRF check in place when deleting files uploaded at the checkout, allowing attackers to make a logged in shop manager or admin delete them via a CSRF attack

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00393 · 32.3th percentile
Published
2022-11-21T00:00Z
EPSS history
Timeline
  • 21 NOV 00:00Z
    Booster for WooCommerce - Checkout Files Deletion via CSRF
    cvelistv5