CVE-2023-4796 — Sensitive Information Exposure in FOR Woocommerce

CWE-200 — Sensitive Information Exposure3 documents3 sources
Severity
4.3MEDIUMNVD
EPSS
0.2%
top 53.76%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Booster FOR Woocommerce
Timeline
PublishedOct 20

Description

The Booster for WooCommerce for WordPress is vulnerable to Information Disclosure via the 'wcj_wp_option' shortcode in versions up to, and including, 7.1.0 due to insufficient controls on the information retrievable via the shortcode. This makes it possible for authenticated attackers, with subscriber-level capabilities or above, to retrieve arbitrary sensitive site options.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages1 packages

▶NVDbooster/booster< 7.1.1

Patches

Patch: plugins.trac.wordpress.org ↗Patch: www.wordfence.com ↗Patch: plugins.trac.wordpress.org ↗

🔴Vulnerability Details

2
CVEList
Booster for WooCommerce <= 7.1.0 - Authenticated (Subscriber+) Information Disclosure via Shortcode↗2023-10-20
▶
GHSA
GHSA-55h7-hprj-3g5x: The Booster for WooCommerce for WordPress is vulnerable to Information Disclosure via the 'wcj_wp_option' shortcode in versions up to, and including,↗2023-10-20
▶
CVE-2023-4796 — Sensitive Information Exposure | cvebase