CVE-2021-34646: Booster For WooCommerce Auth Bypass Flaw

CVE-2021-34646 Overview

CVE-2021-34646 is a critical authentication bypass vulnerability affecting the Booster for WooCommerce WordPress plugin. Versions up to and including 5.4.3 are vulnerable to authentication bypass via the process_email_verification function due to a random token generation weakness in the reset_and_mail_activation_link function found in the ~/includes/class-wcj-emails-verification.php file. This allows attackers to impersonate users and trigger an email address verification for arbitrary accounts, including administrative accounts, and automatically be logged in as that user.

Critical Impact

Unauthenticated attackers can bypass authentication and gain administrative access to WordPress sites running vulnerable versions of Booster for WooCommerce, leading to complete site compromise.

Affected Products

• Booster for WooCommerce versions up to and including 5.4.3
• WordPress installations with the Email Verification module active
• Sites with Login User After Successful Verification setting enabled (default configuration)

Discovery Timeline

• 2021-08-30 - CVE-2021-34646 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2021-34646

Vulnerability Analysis

This authentication bypass vulnerability stems from a weak random token generation mechanism in the email verification process. The reset_and_mail_activation_link function generates predictable verification tokens that attackers can compute or guess, allowing them to forge valid email verification requests for any user account on the affected WordPress site.

The vulnerability is particularly dangerous because the plugin's default configuration enables automatic login upon successful email verification. When combined with the weak token generation, this creates a direct path for attackers to authenticate as any user, including site administrators, without requiring credentials.

For the vulnerability to be exploitable, two conditions must be met: the Email Verification module must be active in the plugin, and the Login User After Successful Verification setting must be enabled. However, since this setting is enabled by default, most installations running vulnerable versions are at risk.

Root Cause

The root cause of this vulnerability lies in CWE-330 (Use of Insufficiently Random Values) and CWE-290 (Authentication Bypass by Spoofing). The reset_and_mail_activation_link function in class-wcj-emails-verification.php generates verification tokens using an insufficiently random algorithm, making the tokens predictable. This weakness allows attackers to compute valid tokens for target accounts without needing access to the legitimate verification emails.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker can target any user account on a vulnerable WordPress site by:

1. Identifying a target user account (e.g., an administrator)
2. Computing or predicting the weak verification token generated for that account
3. Crafting a malicious verification request using the predicted token
4. Triggering the process_email_verification function with the forged token
5. Being automatically logged in as the target user due to the default auto-login setting

The vulnerability can be exploited remotely with complete confidentiality, integrity, and availability impact on the affected system.

Detection Methods for CVE-2021-34646

Indicators of Compromise

• Unexpected email verification requests in WordPress logs
• Suspicious administrator login events without corresponding credential authentication
• Multiple verification attempts for high-privilege accounts from external IP addresses
• Unusual activity patterns in WooCommerce administrative functions

Detection Strategies

• Monitor WordPress authentication logs for verification-based logins to administrative accounts
• Implement alerting for email verification events that originate from unexpected IP addresses
• Review access logs for requests to the email verification endpoint with unusual patterns
• Enable detailed logging on the Booster for WooCommerce plugin to capture verification events

Monitoring Recommendations

• Deploy web application firewalls (WAF) with rules to detect exploitation attempts against the email verification endpoint
• Implement real-time monitoring of WordPress user authentication events
• Set up alerts for new administrator sessions that bypass normal login procedures
• Regularly audit user accounts for unauthorized access or privilege changes

How to Mitigate CVE-2021-34646

Immediate Actions Required

• Update Booster for WooCommerce to a version newer than 5.4.3 immediately
• Temporarily disable the Email Verification module if an immediate update is not possible
• Disable the "Login User After Successful Verification" setting as a temporary mitigation
• Review administrator accounts for any signs of unauthorized access
• Audit recent WordPress login events for suspicious verification-based authentications

Patch Information

The vendor has released a security patch addressing this vulnerability. The fix is available in the WordPress WooCommerce Changeset. For detailed technical analysis of the vulnerability and patch, refer to the Wordfence Blog Vulnerability Analysis.

Workarounds

• Disable the Email Verification module in Booster for WooCommerce plugin settings
• Set "Login User After Successful Verification" to disabled in the plugin configuration
• Implement additional authentication factors for administrator accounts
• Use a WordPress security plugin to add an extra layer of protection to the login process
• Consider temporarily deactivating the plugin until an update can be applied

# Configuration example
# To disable auto-login after verification via wp-config.php
# Add this before "That's all, stop editing!"
define('WCJ_EMAIL_VERIFICATION_SKIP_AUTO_LOGIN', true);

# Alternatively, disable the module via WP-CLI
wp option update wcj_emails_verification_enabled "no"