High severity8.1NVD Advisory· Published Apr 4, 2025· Updated Jun 17, 2026

CVE-2024-13744

Description

The Booster for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the validate_product_input_fields_on_add_to_cart function in versions 4.0.1 to 7.2.4. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Booster/Booster For Woocommercellm-fuzzy2 versions
>=4.0.1, <=7.2.4+ 1 more
- (no CPE)range: >=4.0.1, <=7.2.4
- (no CPE)range: 4.0.1
WordPress/Booster For Woocommercewp-canonicalize
Package: https://wordpress.org/plugins/booster-for-woocommerce

Patches

Vulnerability mechanics

References

plugins.trac.wordpress.org/changeset/3262569/woocommerce-jetpack/trunk/includes/input-fields/class-wcj-product-input-fields-core.phpnvdPatch
www.wordfence.com/threat-intel/vulnerabilities/id/f8e1aca8-3d82-4b1a-98c8-29501a377846nvdThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.526
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000