Vulnerability record · CVE-2021-34646 · published 30 August 2021
CVE-2021-34646: Booster for WooCommerce authentication bypass via weak email verification token
Booster · Booster For Woocommerce
Booster for WooCommerce WordPress plugin versions up to and including 5.4.3 generate a predictable token in reset_and_mail_activation_link, which process_email_verification accepts, allowing authentication bypass. An attacker can impersonate any account, including administrators, and be logged in automatically. The Email Verification module must be active and the default Login User After Successful Verification setting enabled.
Description
Versions up to, and including, 5.4.3, of the Booster for WooCommerce WordPress plugin are vulnerable to authentication bypass via the process_email_verification function due to a random token generation weakness in the reset_and_mail_activation_link function found in the ~/includes/class-wcj-emails-verification.php file. This allows attackers to impersonate users and trigger an email address verification for arbitrary accounts, including administrative accounts, and automatically be logged in as that user, including any site administrators. This requires the Email Verification module to be active in the plugin and the Login User After Successful Verification setting to be enabled, which it is by default.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Automated analysis
critical priorityCVSS 9.8 with unauthenticated network exploitation, default-enabled conditions, and public exploit references make this a critical risk.
What it is
Booster for WooCommerce WordPress plugin versions up to and including 5.4.3 generate a predictable token in reset_and_mail_activation_link, which process_email_verification accepts, allowing authentication bypass. An attacker can impersonate any account, including administrators, and be logged in automatically. The Email Verification module must be active and the default Login User After Successful Verification setting enabled.
Impact
An unauthenticated attacker gains full session access as an arbitrary user, including site administrators, leading to complete site takeover.
Attack surface
Reachable over the network through the plugin's email verification endpoint with no authentication and no user interaction, per the CVSS vector AV:N/AC:L/PR:N/UI:N. Exploitation depends on the Email Verification module being active and the default login-after-verification setting being on.
Exploitation
Not listed in CISA KEV, but EPSS is 0.50869 (98.9th percentile) and references carry an Exploit tag, indicating public exploit information exists.
What to do
- Update Booster for WooCommerce to a version after 5.4.3 (patch changeset 2581212).
- If patching is not immediate, disable the Email Verification module or turn off Login User After Successful Verification.
- Audit administrator accounts and sessions for unexpected logins or changes.
- Remove or restrict the plugin if it is unused.
Detection
- Review web server and plugin logs for requests to the email verification endpoint with unusual or sequential tokens.
- Monitor for successful logins to administrator accounts from unexpected IPs or without prior credential use.
- Check for new admin users, option changes, or plugin/theme modifications following verification events.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2581212%40woocommerce-jetpack&new=25812 | PatchThird Party Advisory |
| https://www.wordfence.com/blog/2021/08/critical-authentication-bypass-vulnerability-patched-in-booster-for-woocommerce/ | ExploitThird Party Advisory |
| https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2581212%40woocommerce-jetpack&new=25812 | PatchThird Party Advisory |
| https://www.wordfence.com/blog/2021/08/critical-authentication-bypass-vulnerability-patched-in-booster-for-woocommerce/ | ExploitThird Party Advisory |
Track CVE-2021-34646 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2021-34646), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.
