CVE-2022-4016

Booster for WooCommerce - Custom Role Creation/Deletion via CSRF

Medium · published December 12, 2022

CVSS v3.1
6.5
EPSS
0%
Percentile
28.0
In the wild
Unconfirmed
What it is

The Booster for WooCommerce WordPress plugin before 5.6.7, Booster Plus for WooCommerce WordPress plugin before 5.6.6, Booster Elite for WooCommerce WordPress plugin before 1.1.8 does not properly check for CSRF when creating and deleting Customer roles, allowing attackers to make logged admins create and delete arbitrary custom roles via CSRF attacks

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00355 · 28.0th percentile
Published
2022-12-12T17:57Z
EPSS history
Timeline
  • 12 DEC 17:57Z
    Booster for WooCommerce - Custom Role Creation/Deletion via CSRF
    cvelistv5