Introduction
Attackers can upload arbitrary files to vulnerable e-commerce sites running Booster for WooCommerce, potentially achieving remote code execution without authentication. The flaw affects thousands of WordPress installations, and the plugin is central to the checkout and order management workflows of many online stores.
Booster for WooCommerce is a WordPress plugin with over 80 modules that extend WooCommerce, and it is widely used. Because so many e-commerce sites run it, a vulnerability in the plugin can have significant downstream effects on online businesses and their customers.
Technical Information
CVE-2024-13342 is an arbitrary file upload vulnerability in the 'add_files_to_order' function of Booster for WooCommerce, affecting all versions up to and including 7.2.4. The function does not validate the file type of user-supplied uploads attached to orders. The plugin does not enforce a whitelist of allowed file types, and its MIME type checks are inadequate, so attackers can upload files with double extensions such as shell.php.jpg.
On certain server configurations, particularly those that execute files based on the first extension, the server may interpret and execute an uploaded file like malicious.php.jpg as PHP code. That can lead to full remote code execution on the affected server.
The vulnerability is unauthenticated, so any user can exploit it without credentials. The root cause is weak input validation and insecure handling of uploaded files in that function:
The issue is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type).
Affected Systems and Versions
- Product: Booster for WooCommerce plugin for WordPress
- Affected versions: All versions up to and including 7.2.4
- Vulnerable function: 'add_files_to_order'
- Vulnerable configurations: Servers that execute files based on the first extension in a double extension filename (e.g.,
file.php.jpg)
Vendor Security History
Booster for WooCommerce (Pluggabl) has had several similar vulnerabilities:
- CVE-2024-12278: Stored XSS in versions up to 7.2.5
- CVE-2024-13744: Arbitrary file upload in versions 4.0.1 through 7.2.4
- CVE-2024-1986: Arbitrary file upload in Booster Elite for WooCommerce up to 7.1.7
The pattern suggests recurring problems with secure file handling and input validation. The vendor has responded to disclosures and issued patches, but the frequency of these vulnerabilities points to a need for stronger security development practices.
