CVE-2022-4017 Booster for WooCommerce - Multiple CSRF
Attackers can trick logged-in users into performing unwanted actions due to missing or flawed CSRF checks in the Booster for WooCommerce plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2022-4017?
CVE-2022-4017 is a high-severity vulnerability in Unknown Booster Elite for WooCommerce, published on 23 Jan 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The Booster for WooCommerce WordPress plugin before 6.0.1, Booster Plus for WooCommerce WordPress plugin before 6.0.1, Booster Elite for WooCommerce WordPress plugin before 6.0.1 have either flawed CSRF checks or are missing them completely in numerous places, allowing attackers to make logged in users perform unwanted actions via CSRF attacks
Which versions are affected by CVE-2022-4017?
It affects 3 products.
Products include Booster Booster Elite Woocommerce, Booster Booster for Woocommerce, Booster Booster Plus Woocommerce.
How do I fix CVE-2022-4017?
No fix has been published for CVE-2022-4017 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-4017 being exploited?
There is no known exploitation of CVE-2022-4017 in the wild and no public exploit code.
Sources
Also known as GHSA-vq5p-mxwf-g858.