CVE-2023-25996

6.5Medium

Published 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

6.5Medium

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None
Impact: High impact on confidentiality
Weakness: CWE-201

Impact

Authenticated attackers with low-level accounts can retrieve arbitrary WordPress options, exposing sensitive configuration details and credentials. They need valid user credentials on the WordPress site to exploit this.

Root cause

The plugin exposes sensitive database options directly into transmitted response data without checking permissions.

Affected systems

Booster Elite for WooCommerce versions prior to 8.4.0

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Fix & remediation

Upgrade Booster Elite for WooCommerce to version 8.4.0 or later. If patching immediately is not possible, deactivate the plugin.

shell

$ wp plugin update booster-elite-for-woocommerce

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Insertion of Sensitive Information Into Sent Data vulnerability in Pluggabl LLC. Booster Elite for WooCommerce booster-elite-for-woocommerce allows Retrieve Embedded Sensitive Data.This issue affects Booster Elite for WooCommerce: from n/a before 8.4.0.

References

https://patchstack.com/database/wordpress/plugin/booster-elite-for-woocommerce/vulnerability/wordpress-booster-elite-for-woocommerce-plugin-8-4-0-authenticated-arbitrary-wordpress-option-disclosure-vulnerability?_s_id=cve

Source: nvd.nist.gov/vuln/detail/CVE-2023-25996