CVE-2024-1986 in Elite Booster for WooCommerce Plugin
Summary
by MITRE • 03/07/2024
The Booster Elite for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the wc_add_new_product() function in all versions up to, and including, 7.1.7. This makes it possible for customer-level attackers, and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. This is only exploitable when the user product upload functionality is enabled.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 04/12/2026
The vulnerability identified as CVE-2024-1986 affects the Booster Elite for WooCommerce plugin, a popular WordPress extension that enhances e-commerce functionality. This security flaw exists within the wc_add_new_product() function, which handles product upload capabilities within the plugin's user interface. The vulnerability represents a critical security weakness that directly impacts the integrity and security posture of WordPress sites utilizing this plugin. The affected versions range from the initial release through version 7.1.7, indicating a prolonged period during which this vulnerability remained undetected and exploitable. The flaw specifically targets the validation mechanisms that should prevent unauthorized file uploads, creating a pathway for malicious actors to compromise affected systems.
The technical implementation of this vulnerability stems from the absence of proper file type validation within the wc_add_new_product() function. This function, designed to process product uploads from users, fails to adequately verify the file extensions, MIME types, or content signatures of uploaded files. The missing validation creates a condition where attackers can bypass normal security checks and upload files with potentially dangerous extensions such as .php, .jsp, or other server-side script formats. This flaw aligns with CWE-434, which describes the weakness of allowing files to be uploaded to a web application without proper validation. The vulnerability is particularly concerning because it operates at the customer level, meaning that even users with limited privileges can exploit this weakness to gain unauthorized access to the server's file system.
The operational impact of CVE-2024-1986 extends beyond simple unauthorized file uploads, as it creates a potential pathway for remote code execution on affected servers. When combined with the plugin's functionality that enables user product uploads, attackers can upload malicious scripts that execute with the privileges of the web server. This escalation of privileges allows for complete system compromise, data exfiltration, and potential lateral movement within network environments. The vulnerability's exploitability is directly tied to the activation of user product upload functionality, making it particularly dangerous for online stores that enable customer-generated content features. The implications of this vulnerability align with ATT&CK technique T1505.003, which covers server-side include attacks through file upload capabilities, and T1059.007, which addresses scripting through web shells.
Organizations affected by this vulnerability should immediately implement mitigations to protect their WordPress installations. The primary recommendation involves upgrading to the latest version of the Booster Elite plugin where this vulnerability has been addressed. However, in cases where immediate upgrades are not feasible, administrators should consider implementing additional security controls such as restricting file upload capabilities, implementing strict file type whitelisting, and deploying web application firewalls to monitor and block suspicious upload attempts. The vulnerability also underscores the importance of proper input validation and the principle of least privilege in web application development, as outlined in the OWASP Top Ten security principles. Regular security audits and vulnerability assessments should be conducted to identify similar weaknesses in other plugins and themes, as this vulnerability demonstrates how seemingly minor validation flaws can create significant security risks.