Booster for WooCommerce Arbitrary File Upload Vulnerability (CVE-2024-13342) — High Severity

The “Booster for WooCommerce” plugin, a popular addition for WordPress e-commerce websites, has been identified with a serious security vulnerability, officially tagged as CVE-2024-13342. At its core, this flaw is an “arbitrary file upload” issue. This means that an attacker, without needing to log in or have special permissions, could potentially upload malicious files to a website running the affected plugin. The problem lies within the ‘add_files_to_order’ function, which fails to properly check the types of files users are uploading. In specific server setups, these maliciously crafted files, often using “double extensions” (like image.php.jpg), could be executed, paving the way for a complete compromise of the website.

CVE Details

Product: Booster for WooCommerce plugin for WordPress
Published: August 29, 2025
Severity: High
Status: Analyzed

Affected Products

This vulnerability impacts all versions of the Booster for WooCommerce plugin up to, and including, version 7.2.4. If your WordPress site uses this plugin and has not been updated beyond this version, it is at significant risk.

Current Status

The vulnerability has been thoroughly analyzed and publicly disclosed. The developers of the Booster for WooCommerce plugin have released a fix in subsequent versions, making it crucial for users to update their installations.

Severity Level

Rated with a High severity and a CVSS score of 8.1, CVE-2024-13342 poses a significant threat. The ability for unauthenticated attackers to upload arbitrary files is a critical weakness. When combined with server configurations that might interpret the first extension in a double-extended file (e.g., executing php from file.php.jpg), this vulnerability can lead directly to Remote Code Execution (RCE). An RCE attack grants the attacker the power to run commands on the affected server, which could involve stealing sensitive customer data, defacing the website, injecting further malware, or even taking over the entire server. This high impact underscores the urgency for all users of the Booster for WooCommerce plugin to take immediate action.

Possible Solutions

The most crucial step to secure your website against this vulnerability is to update the “Booster for WooCommerce” plugin without delay. The vulnerability affects all versions up to and including 7.2.4. Therefore, upgrading to version 7.2.5 or any later available version is essential, as these updates are expected to contain the necessary security patches addressing the file type validation flaw. Before initiating any plugin or theme updates, always ensure you have a complete and recent backup of your website. This practice helps safeguard your data in case any unexpected issues arise during the update process.

For those unable to update immediately, a temporary measure could involve disabling the Booster for WooCommerce plugin until a proper patch can be applied. Additionally, implementing a robust Web Application Firewall (WAF) can provide an extra layer of defense by detecting and blocking suspicious file upload attempts. However, it’s vital to remember that a WAF is a perimeter defense and not a substitute for patching the underlying vulnerability. Furthermore, website administrators should regularly review their server configurations to ensure that file execution policies are as restrictive as possible and that all user-uploaded content undergoes strict validation for both file type and content.

For broader protection, always follow robust WordPress security best practices.

References

https://plugins.trac.wordpress.org/browser/woocommerce-jetpack/tags/7.2.4/includes/class-wcj-checkout-files-upload.php#L452

https://plugins.trac.wordpress.org/changeset/3262569/

https://www.wordfence.com/threat-intel/vulnerabilities/id/5ac8a125-121c-4392-846e-625726043972?source=cve