CVE-2024-13342
📋 TL;DR
The Booster for WooCommerce WordPress plugin allows unauthenticated attackers to upload arbitrary files with double extensions due to missing file type validation. This vulnerability affects all versions up to 7.2.4 and can lead to remote code execution on servers configured to execute files based on the first extension. WordPress sites using this plugin are affected.
💻 Affected Systems
- Booster for WooCommerce WordPress plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete server compromise, data theft, and website defacement.
Likely Case
File upload leading to webshell deployment and limited server access.
If Mitigated
File upload blocked by server configuration or web application firewall.
🎯 Exploit Status
Exploitation requires specific server configuration but is straightforward when conditions are met.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 7.2.5
Vendor Advisory: https://plugins.trac.wordpress.org/changeset/3262569/
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find 'Booster for WooCommerce' and update to version 7.2.5 or later. 4. Verify update completes successfully.
🔧 Temporary Workarounds
Disable plugin
allTemporarily disable the vulnerable plugin until patched.
wp plugin deactivate woocommerce-jetpack
Web Application Firewall rule
allBlock requests to the vulnerable endpoint.
Block POST requests to /wp-admin/admin-ajax.php?action=wcj_add_files_to_order
🧯 If You Can't Patch
- Disable the Booster for WooCommerce plugin immediately
- Implement strict file upload restrictions at the web server level
🔍 How to Verify
Check if Vulnerable:
Check WordPress plugin version: wp plugin get woocommerce-jetpack --field=versionCheck Version:
wp plugin get woocommerce-jetpack --field=versionVerify Fix Applied:
Confirm plugin version is 7.2.5 or higher: wp plugin get woocommerce-jetpack --field=version📡 Detection & Monitoring
Log Indicators:
- Multiple POST requests to /wp-admin/admin-ajax.php with action=wcj_add_files_to_order
- File uploads with double extensions (.php.jpg, .php.png)
Network Indicators:
- Unusual file uploads to WordPress admin-ajax endpoint
- POST requests with file uploads from unauthenticated sources
SIEM Query:
source="web_logs" AND uri="/wp-admin/admin-ajax.php" AND query="action=wcj_add_files_to_order" AND method="POST"