CVE-2022-4017

Booster for WooCommerce - Multiple CSRF

The Booster for WooCommerce WordPress plugin before 6.0.1, Booster Plus for WooCommerce WordPress plugin before 6.0.1, Booster Elite for WooCommerce WordPress plugin before 6.0.1 have either flawed CSRF checks or are missing them completely in numerous places, allowing attackers to make logged in users perform unwanted actions via CSRF attacks

Affected

Booster for WooCommerce · Booster Plus for WooCommerce · Booster Elite for WooCommerce

CVSS v3.1 NVD

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

0.34% chance of exploitation in the next 30 days, 26th percentile

Published

2023-01-23

Updated

2025-04-02

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/609072d0-9bb9-4fe0-9626-7e4a334ca3a4

References

• CVE Record
• NVD entry