CVE-2022-3763 Booster for WooCommerce - Checkout Files Deletion via CSRF
Attackers can trick logged-in administrators into deleting checkout files via CSRF, compromising data integrity in WooCommerce stores.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2022-3763?
CVE-2022-3763 is a high-severity vulnerability in Unknown Booster Elite for WooCommerce, published on 21 Nov 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The Booster for WooCommerce WordPress plugin before 5.6.7, Booster Plus for WooCommerce WordPress plugin before 5.6.5, Booster Elite for WooCommerce WordPress plugin before 1.1.7 do not have CSRF check in place when deleting files uploaded at the checkout, allowing attackers to make a logged in shop manager or admin delete them via a CSRF attack
Which versions are affected by CVE-2022-3763?
It affects 1 product.
Products include Booster Booster for Woocommerce.
How do I fix CVE-2022-3763?
No fix has been published for CVE-2022-3763 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-3763 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-3763 exists.
Other vulnerabilities in Unknown Booster Elite for WooCommerce
- CVE-2021-34646 Booster for WooCommerce <= 5.4.3 Authentication Bypass
- CVE-2024-1986 Elite Booster for WooCommerce <= 7.1.7 - Authenticated (Subscriber+) Arbitrary File Upload
- CVE-2024-13342 Booster for WooCommerce <= 7.2.4 - Unauthenticated Double Extension Arbitrary File Upload
- CVE-2024-13744 Booster for WooCommerce 4.0.1 - 7.2.4 - Unauthenticated Arbitrary File Upload
- CVE-2024-13708 Booster for WooCommerce 4.0.1 - 7.2.4 - Unauthenticated Stored Cross-Site Scripting
Sources
Also known as GHSA-q4cg-p4wr-gxc3.