CVE-2024-3957CWE-94

Booster for WooCommerce <= 7.1.8 - Unauthenticated Arbitrary Shortcode Execution

Medium · published May 2, 2024

CVSS v3.1
6.5
EPSS
1%
Percentile
58.8
In the wild
Unconfirmed
What it is

The Booster for WooCommerce plugin is vulnerable to Unauthenticated Arbitrary Shortcode Execution in versions up to, and including, 7.1.8. This allows unauthenticated attackers to execute arbitrary shortcodes. The severity and exploitability depends on what other plugins are installed and what shortcode functionality they provide.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00884 · 58.8th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2024-05-02T16:51Z
EPSS history
Timeline
  • 02 MAY 16:51Z
    Booster for WooCommerce <= 7.1.8 - Unauthenticated Arbitrary Shortcode Execution
    cvelistv5