Arbitrary File Upload Vulnerability in Booster for WooCommerce Plugin by WordPress
CVE-2024-13342

8.1HIGH

Key Information:

Vendor

WordPress
Status
Booster For WooCommerce – PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools
Vendor
CVE Published:
29 August 2025

What is CVE-2024-13342?

The Booster for WooCommerce plugin for WordPress is susceptible to arbitrary file uploads due to inadequate file type validation in the 'add_files_to_order' function. This vulnerability is present in all versions up to and including 7.2.4. Unauthenticated attackers can exploit this flaw to upload files with double extensions on the server of affected sites, which may enable remote code execution if the server configuration allows execution of the first extension.

Affected Version(s)

Booster for WooCommerce – PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools * <= 7.2.4

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/woocommerce-je...
https://plugins.trac.wordpress.org/changeset/3262569/

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

lucky_buddy
.