CVE Vulnerability

CVE-2022-4016

The Booster for WooCommerce WordPress plugin before 5.6.7, Booster Plus for WooCommerce WordPress plugin before 5.6.6, Booster Elite for WooCommerce WordPress plugin before 1.1.8 does not properly check for CSRF when creating and deleting Customer roles, allowing attackers to make logged admins create and delete arbitrary custom roles via CSRF attacks

6.5 /10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://wpscan.com/vulnerability/9b77044c-fd3f-4e6f-a759-dcc3082dcbd6 Exploit Third Party Advisory
Configurations

Configuration 1

cpe:2.3:a:booster:booster_for_woocommerce:*:*:*:*:*:wordpress:*:*
cpe:2.3:a:booster:booster_for_woocommerce:*:*:*:*:plus:wordpress:*:*
cpe:2.3:a:booster:booster_for_woocommerce:*:*:*:*:elite:wordpress:*:*
Information

Published : 2022-12-12 06:15

Updated : 2022-12-15 02:00

NVD link : CVE-2022-4016

Mitre link : CVE-2022-4016

Products Affected
No products.
CWE
CWE-352