CVE-2021-34646

What it actually does

Booster for WooCommerce versions up to and including 5.4.3 contain an authentication bypass in the Email Verification module. A weakness in token generation within reset_and_mail_activation_link, combined with process_email_verification behavior, can allow an unauthenticated remote attacker to trigger verification for arbitrary accounts and be automatically logged in as that account. When the targeted account is an administrator, the attacker gains full WordPress administrative access, enabling plugin/theme modification, user creation, configuration changes, data access, and potential remote code execution through normal WordPress admin capabilities.

Why it matters to the business

A successful exploit can give an external attacker control of a WordPress/WooCommerce site, including administrative control of storefront settings, customer data, orders, payment-related workflows, content, and installed plugins. For e-commerce sites this can lead to fraud, customer data exposure, storefront defacement, malware injection, SEO spam, checkout manipulation, business disruption, and reputational damage. The high CVSS score, public exploit availability, and elevated EPSS probability indicate this should be treated as a high-priority internet-facing WordPress risk even though it is not listed in CISA KEV.

How an attack unfolds

An attacker identifies a WordPress site using the vulnerable Booster for WooCommerce plugin with the Email Verification module enabled and the default setting that logs users in after successful verification. The attacker then abuses the plugin’s email verification workflow to request or derive a weak verification token for a chosen account, such as an administrator. By submitting the crafted verification request to the plugin endpoint, the attacker causes the site to treat the target account as verified and initiates an authenticated session as that user. Once logged in as an administrator, the attacker can create persistence through new admin users, install or edit plugins and themes, upload web shells where permitted, change WooCommerce settings, access customer and order information, inject malicious JavaScript, or redirect payments and traffic.

How to fix it

Upgrade Booster for WooCommerce to a version newer than 5.4.3 that contains the vendor fix. If an immediate upgrade is not possible, disable the Booster for WooCommerce Email Verification module or disable the setting that logs users in automatically after successful verification. Restrict WordPress administrative access, enforce multi-factor authentication for administrators where available, review all administrator accounts, and rotate credentials for privileged users after remediation. Remove unused plugins and themes, ensure WordPress core and all plugins are current, and consider placing the site behind a web application firewall rule set that can limit suspicious requests to plugin verification endpoints.

How to confirm the fix worked

Confirm the installed Booster for WooCommerce version is greater than 5.4.3 and that no vulnerable copy remains active. In the WordPress admin interface or filesystem, verify the plugin version from the plugin metadata and confirm the Email Verification module and auto-login-after-verification setting are disabled if the plugin has not yet been upgraded. Test that email verification links cannot log a user in without a legitimate, unpredictable token tied to that account. Review WordPress users for unexpected administrator accounts, validate plugin/theme integrity, and confirm no recently modified PHP files or unauthorized plugins were added during the exposure window.

Typical attack path

1. Scan for WordPress sites running Booster for WooCommerce versions up to and including 5.4.3.
2. Confirm the Email Verification module is active and that automatic login after successful verification is enabled.
3. Identify a high-value target account, commonly a WordPress administrator account.
4. Trigger the vulnerable email verification workflow using the weak token behavior.
5. Submit the verification request and obtain an authenticated session as the targeted user.
6. Use WordPress administrative access to create persistence, modify site content, install malicious plugins/themes, access WooCommerce data, or deploy further malware.

How to detect it

To determine whether exploitation already occurred, review web server access logs, WordPress authentication logs, security plugin logs, and WooCommerce/WordPress admin activity for suspicious verification requests followed by successful logins as existing users, especially administrators. Focus on requests involving Booster for WooCommerce email verification functionality and the plugin file path includes/class-wcj-emails-verification.php, particularly where the source IP has no prior association with the account. Correlate email verification events with login events, new administrator creation, plugin or theme installation, file edits, option changes, WooCommerce payment/shipping setting changes, and unexpected checkout script modifications. On disk, inspect wp-content/plugins, wp-content/themes, uploads directories, and recently modified PHP files for web shells or malicious plugin additions. Also review outbound email logs for unexpected verification emails generated for administrator accounts.

• wp-content/plugins/booster-plus-for-woocommerce/includes/class-wcj-emails-verification.php
• wp-content/plugins/booster-for-woocommerce/includes/class-wcj-emails-verification.php
• class-wcj-emails-verification.php
• process_email_verification
• reset_and_mail_activation_link
• Email Verification
• Login User After Successful Verification
• /wp-admin/plugin-editor.php
• /wp-admin/theme-editor.php
• /wp-admin/plugins.php?action=activate
• /wp-admin/user-new.php
• /wp-content/plugins/
• /wp-content/themes/
• /wp-content/uploads/

What your security team should do

• Immediately inventory internet-facing WordPress/WooCommerce sites for Booster for WooCommerce versions up to and including 5.4.3.
• Upgrade affected installations to a fixed version newer than 5.4.3 or disable the vulnerable Email Verification module and automatic login behavior until patching is complete.
• Prioritize sites that process orders, customer data, or payment-related workflows because administrator compromise can directly affect revenue and customer trust.
• Hunt for suspicious administrator logins, new admin users, unexpected plugin/theme changes, and verification-related requests during the period of exposure.
• Reset passwords and invalidate active sessions for administrator accounts after patching if exploitation is suspected.
• Inspect WooCommerce settings, payment configuration, checkout pages, injected scripts, redirects, and recently changed PHP files for signs of tampering.
• Deploy or tune WAF and SIEM detections for unusual requests to Booster for WooCommerce email verification functionality and unexpected WordPress admin activity.