CVE-2024-13342: Booster For WooCommerce RCE Vulnerability

CVE-2024-13342 Overview

CVE-2024-13342 is a critical arbitrary file upload vulnerability affecting the Booster for WooCommerce plugin for WordPress. The vulnerability exists due to missing file type validation in the add_files_to_order function, allowing unauthenticated attackers to upload arbitrary files with double extensions to the affected site's server. This weakness can potentially lead to remote code execution on vulnerable WordPress installations where server configurations execute the first extension present in uploaded files.

Critical Impact

Unauthenticated attackers can upload malicious files to WordPress servers, potentially achieving remote code execution without any authentication required.

Affected Products

• Booster for WooCommerce plugin versions up to and including 7.2.4
• WordPress installations with vulnerable Booster for WooCommerce configurations
• Sites with server configurations that execute the first extension in double-extension filenames

Discovery Timeline

• 2025-08-29 - CVE-2024-13342 published to NVD
• 2025-12-08 - Last updated in NVD database

Technical Details for CVE-2024-13342

Vulnerability Analysis

This vulnerability is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type). The core issue resides in the add_files_to_order function within the checkout files upload module of the Booster for WooCommerce plugin. The function fails to properly validate file types before accepting uploads, creating a significant security gap that allows attackers to bypass intended restrictions.

The attack can be performed remotely without requiring any authentication or user interaction. The vulnerable function processes file uploads during the checkout workflow, and without proper validation, accepts files regardless of their actual content type or extension combination. Successful exploitation can result in complete compromise of the affected WordPress installation, including unauthorized access to sensitive data, modification of site content, and potential lateral movement within the hosting environment.

Root Cause

The root cause of CVE-2024-13342 is the absence of file type validation in the add_files_to_order function located in class-wcj-checkout-files-upload.php. The function accepts uploaded files without verifying that the file extension and MIME type match allowed formats. This allows attackers to craft filenames with double extensions (e.g., malicious.php.jpg) that may be executed as PHP code depending on server configuration.

Attack Vector

The attack exploits the file upload functionality accessible through the WooCommerce checkout process. An unauthenticated attacker can submit a specially crafted HTTP request containing a malicious file with a double extension. On servers configured to process files based on the first extension encountered, the uploaded file would be executed as server-side code rather than treated as the innocuous file type suggested by the trailing extension.

The vulnerability is accessible via the network without authentication. Attackers can craft malicious upload requests targeting the checkout file upload endpoint, exploiting the lack of validation to place executable files on the server. The specific exploitability depends on server configuration—particularly Apache servers with certain AddHandler directives or misconfigured MIME type handling.

For detailed technical analysis, refer to the WordPress Checkout File Upload Code and the Wordfence Vulnerability Analysis.

Detection Methods for CVE-2024-13342

Indicators of Compromise

• Presence of files with double extensions (e.g., .php.jpg, .php.png) in WordPress upload directories
• Unusual files in /wp-content/uploads/ or plugin-specific upload directories
• Web server access logs showing POST requests to checkout upload endpoints with suspicious file names
• Newly created executable files in web-accessible directories with recent timestamps

Detection Strategies

• Monitor file system changes in WordPress upload directories for newly created files with double extensions
• Implement web application firewall (WAF) rules to inspect file upload requests for double extension patterns
• Review Apache/Nginx access logs for POST requests containing potential payload indicators
• Deploy file integrity monitoring on WordPress installations to detect unauthorized file additions

Monitoring Recommendations

• Enable detailed logging for file upload operations in WordPress
• Configure intrusion detection systems to alert on file uploads with suspicious extension combinations
• Regularly audit installed plugin versions and compare against known vulnerable versions
• Monitor outbound connections from web servers that could indicate successful exploitation and callback activity

How to Mitigate CVE-2024-13342

Immediate Actions Required

• Update Booster for WooCommerce to a version newer than 7.2.4 immediately
• Audit existing uploads directories for suspicious files with double extensions
• Temporarily disable the checkout file upload functionality if updates cannot be applied immediately
• Review web server configurations to ensure proper MIME type handling and disable execution of first extensions in double-extension scenarios

Patch Information

The vendor has released a security patch addressing this vulnerability. The fix is available in WordPress Changeset #3262569, which implements proper file type validation in the add_files_to_order function. Site administrators should update to the latest version of Booster for WooCommerce that incorporates this fix. After updating, verify that the plugin version displayed in WordPress is greater than 7.2.4.

Workarounds

• Configure web server to only execute files based on the final extension, not the first
• Implement server-level file upload restrictions using .htaccess rules or Nginx location blocks
• Use a web application firewall to block uploads containing double extensions
• Disable the checkout file upload feature in Booster for WooCommerce settings until the plugin can be updated

# Apache .htaccess configuration to prevent execution of double-extension files
# Add to WordPress root or uploads directory
<FilesMatch "\.php\.">
    Require all denied
</FilesMatch>

# Alternative: Disable PHP execution in uploads directory
<Directory "/var/www/html/wp-content/uploads">
    php_flag engine off
</Directory>