Booster for WooCommerce <= 5.4.3 — Authentication Bypass

Am I affected?

• Check your version: in wp-admin go to Plugins → Installed Plugins and read the version under Booster for WooCommerce – PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools.
• No admin access? Run a passive check of your site. It reads public files only.
• No account is needed to exploit this. Treat any exposed site on an affected version as at risk.

What to do

1. Update to version 5.4.4, or a newer patched version
2. Rotate administrator passwords and application secrets if the site ran a vulnerable version while publicly reachable.
3. Watch Booster for WooCommerce – PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools to get an email when the next vulnerability is published.

Advisory

Source description from Wordfence Intelligence, credited to Chloe Chamberland.

Versions up to, and including, 5.4.3, of the Booster for WooCommerce WordPress plugin are vulnerable to authentication bypass via the process_email_verification function due to a random token generation weakness in the reset_and_mail_activation_link function found in the ~/includes/class-wcj-emails-verification.php file. This allows attackers to impersonate users and trigger an email address verification for arbitrary accounts, including administrative accounts, and automatically be logged in as that user, including any site administrators. This requires the Email Verification module to be active in the plugin and the Login User After Successful Verification setting to be enabled, which it is by default.

Exploits & references

Proof-of-concept & detection

No public proof-of-concept or detection template is known for this vulnerability.

Advisories & patches

• Advisorywordfence.com

Related CVEs

Timeline

1. Aug 24, 2021

   CVE published

   Severity critical, CVSS 9.8

2. Nov 13, 2026

   Record last updated