Read the docs
TI-2023-30880 Aliases CVE-2023-25996GHSA-563f-4p3h-c4jm

Booster Elite for WooCommerce: Authenticated Arbitrary Option Disclosure

Priority LOW 28CWE-201Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-201.

Summary

Booster Elite for WooCommerce by Pluggabl LLC, from n/a before 8.4.0, inserts sensitive information into sent data (CWE-201), exposing embedded sensitive data. An authenticated attacker with low privileges can retrieve arbitrary WordPress options over the network, with impact to confidentiality only. CISA KEV does not list it, and no public exploit link appears in the references.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Insertion of Sensitive Information Into Sent Data vulnerability in Pluggabl LLC. Booster Elite for WooCommerce booster-elite-for-woocommerce allows Retrieve Embedded Sensitive Data.This issue affects Booster Elite for WooCommerce: from n/a before 8.4.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00212 11th percentileScored 2026-11-07
Fix Fixed Booster Elite for WooCommerce (Pluggabl LLC.): 8.4.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
pluggablBooster Elite for WooCommercebefore 8.4.08.4.0Patch availableCNA
  • Booster Elite for WooCommerce Vendorpluggabl Affected before 8.4.0 Fixed in 8.4.0 Patch available CNA

Remediation

Update Booster Elite for WooCommerce to version 8.4.0 or later.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA Booster Elite for WooCommerce (Pluggabl LLC.) Fixed in 8.4.0

Timeline

  1. 2026-10-12 Threatist record created from CVE-2023-25996
  2. 2026-10-12 Alias added: GHSA-563f-4p3h-c4jm
  3. 2026-10-12 CISA SSVC decision points changed
  4. 2026-10-12 Priority changed: MEDIUM → LOW

References

Other 1

  • TI-2021-13660 Booster for WooCommerce <= 5.4.3 Authentication Bypass CVSS 3.1CRITICAL 9.8
  • TI-2022-03454 Booster for WooCommerce - Checkout Files Deletion via CSRF CVSS 3.1HIGH 8.1
  • TI-2022-03685 Booster for WooCommerce - Custom Role Creation/Deletion via CSRF CVSS 3.1MEDIUM 6.5
  • TI-2022-03453 Booster for WooCommerce - ShopManager+ Arbitrary File Download CVSS 3.1MEDIUM 6.5
  • TI-2026-70357 PHP object injection in Booster for WooCommerce WordPress plugin CVSS 3.1CRITICAL 9.8
  • TI-2024-12783 Booster for WooCommerce 4.0.1 - 7.2.4 - Unauthenticated Arbitrary File Upload CVSS 3.1CRITICAL 9.8
See all 40 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences