CVE-2022-4016 Booster for WooCommerce - Custom Role Creation/Deletion via CSRF
Attackers can trick admins into creating or deleting custom roles via CSRF, potentially altering user permissions in WooCommerce.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2022-4016?
CVE-2022-4016 is a medium-severity vulnerability in Unknown Booster Elite for WooCommerce, published on 12 Dec 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The Booster for WooCommerce WordPress plugin before 5.6.7, Booster Plus for WooCommerce WordPress plugin before 5.6.6, Booster Elite for WooCommerce WordPress plugin before 1.1.8 does not properly check for CSRF when creating and deleting Customer roles, allowing attackers to make logged admins create and delete arbitrary custom roles via CSRF attacks
Which versions are affected by CVE-2022-4016?
It affects 1 product.
Products include Booster Booster for Woocommerce.
How do I fix CVE-2022-4016?
No fix has been published for CVE-2022-4016 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-4016 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-4016 exists.
Other vulnerabilities in Unknown Booster Elite for WooCommerce
- CVE-2021-34646 Booster for WooCommerce <= 5.4.3 Authentication Bypass
- CVE-2024-1986 Elite Booster for WooCommerce <= 7.1.7 - Authenticated (Subscriber+) Arbitrary File Upload
- CVE-2024-13342 Booster for WooCommerce <= 7.2.4 - Unauthenticated Double Extension Arbitrary File Upload
- CVE-2024-13744 Booster for WooCommerce 4.0.1 - 7.2.4 - Unauthenticated Arbitrary File Upload
- CVE-2022-3763 Booster for WooCommerce - Checkout Files Deletion via CSRF
Sources
Also known as GHSA-fh57-58q7-6v93.