What is CVE-2022-4016?

CVE-2022-4016 is a medium-severity vulnerability in Booster For Woocommerce, classified under CWE-352 CROSS-SITE REQUEST FORGERY (CSRF). CVSS score: 6.5/10. Published 2022-12-12.

How severe is CVE-2022-4016?

Medium severity. CVSS v3 base score is 6.5 out of 10.

Is CVE-2022-4016 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Booster For Woocommerce

CVE-2022-4016

The Booster for WooCommerce WordPress plugin before 5.6.7, Booster Plus for WooCommerce WordPress plugin before 5.6.6, Booster Elite for WooCommerce WordPress plugin before 1.1.8 does not properly check for CSRF when creating and deleting Customer roles, allowing attackers to make logged admins create and delete arbitrary custom roles via CSRF attacks

EPSS: 0.003 (26.3th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N.

Affected products

Booster Booster_for_woocommerce
Unknown Booster Elite For Woocommerce — versions 0
Unknown Booster For Woocommerce — versions 0
Unknown Booster Plus For Woocommerce — versions 0

Public proof-of-concept exploits

20142995/nuclei-templates

References

contact@wpscan.com (Exploit, technical-description, Third Party Advisory, exploit, vdb-entry)

Frequently asked questions

What is CVE-2022-4016?: CVE-2022-4016 is a medium-severity vulnerability in Booster For Woocommerce, classified under CWE-352 CROSS-SITE REQUEST FORGERY (CSRF). CVSS score: 6.5/10. Published 2022-12-12.
How severe is CVE-2022-4016?: Medium severity. CVSS v3 base score is 6.5 out of 10.
Is CVE-2022-4016 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.