Booster for WooCommerce WordPress Plugin Unauthenticated Arbitrary File Upload Vulnerability

A vulnerability allowing arbitrary file uploads has been identified in the Booster for WooCommerce plugin for WordPress, affecting all versions through 7.2.4. The issue arises from inadequate file type validation in the 'add_files_to_order' function. This vulnerability enables unauthenticated attackers to upload files with double extensions to the server, potentially leading to remote code execution, depending on the server's configuration.

Impact

Exploitation of this vulnerability could allow for arbitrary file uploads, with the potential for remote code execution if the uploaded file is executed by the server.

Reproduction

The vulnerability can be reproduced by uploading a file through the WooCommerce checkout files upload feature, available in versions of the Booster for WooCommerce plugin prior to 7.2.5. The uploaded file can have a double extension, such as '.php.jpg', which may be executed as a PHP file under certain server configurations.

Remediation

Users are advised to update the Booster for WooCommerce plugin to version 7.2.5 or later.