Booster for WooCommerce Unauthenticated Arbitrary File Upload Vulnerability

A vulnerability allowing arbitrary file uploads has been identified in the Booster for WooCommerce plugin for WordPress, affecting versions 4.0.1 prior to 7.2.4. The issue arises from inadequate file type validation in the 'validate_product_input_fields_on_add_to_cart' function. This flaw enables unauthenticated attackers to upload arbitrary files to the affected site's server, potentially leading to remote code execution.

Impact

Exploitation of this vulnerability could allow for arbitrary file uploads, with the possibility of executing uploaded files remotely, depending on the server's configuration.

Remediation

Users are advised to update the Booster for WooCommerce plugin to version 7.2.5 or a newer patched version.