CVE-2021-34646 Booster for WooCommerce <= 5.4.3 Authentication Bypass
Attackers can bypass authentication and log in as any user, including administrators, due to weak token generation in the email verification module.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-34646?
CVE-2021-34646 is a critical authentication bypass vulnerability in Pluggabl LLC Booster for WooCommcerce, published on 30 Aug 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Versions up to, and including, 5.4.3, of the Booster for WooCommerce WordPress plugin are vulnerable to authentication bypass via the process_email_verification function due to a random token generation weakness in the reset_and_mail_activation_link function found in the ~/includes/class-wcj-emails-verification.php file. This allows attackers to impersonate users and trigger an email address verification for arbitrary accounts, including administrative accounts, and automatically be logged in as that user, including any site administrators. This requires the Email Verification module to be active in the plugin and the Login User After Successful Verification setting to be enabled, which it is by default.
Which versions are affected by CVE-2021-34646?
It affects 1 product.
Products include Booster Booster for Woocommerce.
How do I fix CVE-2021-34646?
No fix has been published for CVE-2021-34646 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2021-34646 being exploited?
There is no known exploitation of CVE-2021-34646 in the wild and no public exploit code.
Public exploit code: 1 Exploit-DB entry and 2 proofs of concept on GitHub.
Other vulnerabilities in Pluggabl LLC Booster for WooCommcerce
- CVE-2024-1986 Elite Booster for WooCommerce <= 7.1.7 - Authenticated (Subscriber+) Arbitrary File Upload
- CVE-2024-13342 Booster for WooCommerce <= 7.2.4 - Unauthenticated Double Extension Arbitrary File Upload
- CVE-2024-13744 Booster for WooCommerce 4.0.1 - 7.2.4 - Unauthenticated Arbitrary File Upload
- CVE-2022-3763 Booster for WooCommerce - Checkout Files Deletion via CSRF
- CVE-2024-13708 Booster for WooCommerce 4.0.1 - 7.2.4 - Unauthenticated Stored Cross-Site Scripting
Sources
Also known as GHSA-q3w8-grp4-hc32.