WordPress Plugin Vulnerabilities

Booster for WooCommerce < 7.1.2 - Missing Authorization to Authenticated (Subscriber+) Order Information Disclosure

Description

The Booster for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the init_atts() function in all versions up to, and including, 7.1.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve arbitrary order information.

Affects Plugins

Plugin icon
woocommerce-jetpack
Fixed in 7.1.2

References

CVE
CVE-2023-48333
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/d94661c1-2d70-4943-9452-b51a76116ebb

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Dave Jong
Verified
No
WPVDB ID
c79e8233-465f-4387-9f8a-edbe44d8f14f

Timeline

Publicly Published
2023-11-24 (about 2 years ago)
Added
2023-11-29 (about 2 years ago)
Last Updated
2024-01-22 (about 2 years ago)

Other

Published
Title
Published
2025-04-01
Title
RestroPress <= 3.2.4.2 - Missing Authorization
Published
2023-10-24
Title
TK Google Fonts GDPR Compliant < 2.2.12 - Missing Authorization to Font Deletion
Published
2026-02-03
Title
Fortis for WooCommerce < 1.3.0 - Missing Authorization to Unauthenticated Arbitrary Order Status Update to Paid via 'wc-api' Endpoint
Published
2025-01-16
Title
Delete All Posts <= 1.1.1 - Missing Authorization
Published
2026-02-13
Title
Chocolate House < 1.1.6 - Missing Authorization