CVE-2024-13342: 
WordPress vulnerability analysis and mitigation

The Booster for WooCommerce plugin for WordPress contains a critical vulnerability (CVE-2024-13342) affecting all versions up to and including 7.2.4. The vulnerability is related to arbitrary file uploads due to missing file type validation in the 'addfilesto_order' function, which allows unauthenticated attackers to upload files with double extensions to the affected site's server (NVD).

The vulnerability stems from inadequate file type validation in the 'addfilesto_order' function. This security flaw has been assigned a CVSS v3.1 Base Score of 8.1 (HIGH) with the vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. The vulnerability is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type) (NVD).

The vulnerability allows unauthenticated attackers to upload arbitrary files with double extensions on the affected site's server. This can potentially lead to remote code execution in specific instances where the server configuration executes the first extension present (NVD).

Users should update their Booster for WooCommerce plugin to a version newer than 7.2.4 as soon as possible to mitigate this vulnerability (NVD).