Security readout for executives and security teams
Plain-English summary
A vulnerable Booster for WooCommerce setup can let an unauthenticated attacker become another user, including an administrator. The issue only applies when the plugin’s Email Verification module is active and automatic login after verification is enabled, which the source says is the default.
Executive priority
Treat as urgent for any affected WooCommerce site because compromise can become full site administration without credentials. Prioritize patching and configuration review before lower-impact WordPress plugin issues.
Technical view
CVE-2021-34646 is an authentication bypass in Booster for WooCommerce through 5.4.3. A weak random token in reset_and_mail_activation_link affects process_email_verification, allowing arbitrary account email verification and automatic login when required settings are enabled. CVSS is 9.8 critical and mapped to CWE-290.
Likely exposure
Internet-facing WordPress/WooCommerce sites running Booster for WooCommerce 5.4.3 or earlier with the Email Verification module active are exposed, especially if the default automatic login after verification setting remains enabled.
Exploitation context
The bundle does not cite CISA KEV listing or confirmed active exploitation. The vulnerability is remotely reachable, requires no authentication or user interaction, and can lead to administrator impersonation when the vulnerable configuration is present.
Researcher notes
The vulnerable path is tied to email verification token handling in includes/class-wcj-emails-verification.php. Assessment should focus on installed version and the two configuration prerequisites. Evidence is sufficient for severity and exposure conditions, but active exploitation is not established in the provided sources.
Mitigation direction
- Update Booster for WooCommerce to a release newer than 5.4.3 using vendor or WordPress guidance.
- Disable the Email Verification module until the plugin is updated.
- Disable automatic login after successful verification if the module must remain active.
- Review administrator accounts and recent WordPress logins for unexpected access.
- Check vendor guidance for any additional remediation or cleanup steps.
Validation and detection
- Inventory WordPress sites for Booster for WooCommerce installations.
- Confirm plugin version is greater than 5.4.3.
- Check whether the Email Verification module is active.
- Verify the automatic login after verification setting is disabled or no longer vulnerable.
- Review authentication logs for suspicious administrator sessions around exposure windows.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-290: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCredential and access behavior lookup
The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2021-34646 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://www.wordfence.com/blog/2021/08/critical-authentication-bypass-vulnerability-patched-in-booster-for-woocommerce/CVE reference · x_refsource_MISC
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2581212%40woocommerce-jetpack&new=2581212%40woocommerce-jetpack&sfp_email=&sfph_mail=CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Authentication Bypass by Spoofing
Authentication Bypass by Spoofing represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.