CVE-2023-48747 is a medium severity (CVSS 6.5) improper authentication flaw in Booster for WooCommerce by Pluggabl, affecting versions through 7.1.2. It lets a logged in user reach functionality the plugin did not properly restrict. Update the plugin past 7.1.2 and confirm the fixed release in the advisory.
What's affected
- Booster for WooCommerce by Pluggabl LLC, from the earliest release through 7.1.2, per the NVD record.
- The record describes the issue as accessing functionality not properly constrained by ACLs. The vector requires low privileges.
- The Patchstack entry the record links is titled as an authenticated product creation and modification issue. We could not open the page, so check it for details.
- Fixed version: we could not confirm one from a source we fetched. Check the Patchstack entry and the plugin changelog, and treat any release after 7.1.2 as the one to look for.
- Severity: the record gives CVSS 6.5, which is medium. KEV status: the record shows kev as false, and none of the sources we read report exploitation in the wild.
The CVSS 3.1 vector in the record is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N. Read plainly, it describes an attack over the network, with low attack complexity, requiring low privileges and no user interaction. Impact on confidentiality is none, on integrity high and on availability none. The scope is unchanged, so the impact stays within the vulnerable component.
How to check if you're exposed
Booster for WooCommerce is a WordPress plugin, so the quickest check is the version on the Plugins screen or from WP-CLI on the server.
wp plugin list --fields=name,status,version | grep -i woocommerce-jetpack
wp plugin get woocommerce-jetpack --field=version
Anything at or below 7.1.2 is inside the range in the record. If you manage many sites, run the same command across each one, and check staging and forgotten test sites as well as production. A site with the plugin installed but deactivated is a smaller risk than an active one, yet it is still worth updating or deleting.
The plugin's directory slug in the Patchstack link is woocommerce-jetpack, which is why the commands use that name.
What to do now
- Update Booster for WooCommerce to the latest release from the WordPress dashboard or with WP-CLI, and verify it is later than 7.1.2.
- Read the Patchstack entry to confirm the first fixed version.
- List every user with an account on the shop, including customers, and remove unused ones.
- Check your product catalogue for entries or price changes you did not make.
- Add the plugin to the list your team monitors for new advisories.
Why it matters
The class is CWE-287 (Improper Authentication). The plugin let an account do something that its role should not allow. Because the vector asks only for low privileges, the question that matters is who can obtain an account on your store. On many shops, anyone can register as a customer.
The impact in the vector is integrity only, with no confidentiality or availability effect. That fits a flaw that changes data, such as store content, not one that leaks it. Even so, a changed price or product can cost real money, so it is worth patching quickly.
Quick check
Is this exploitable without logging in?
The record's vector needs low privileges, so an account is required. Check whether your shop allows open registration.
Why is the fixed version not stated?
The only reference in the record was a Patchstack page we could not retrieve. Check it directly before you rely on a version number.
Sources
Last reviewed: 19 October 2026.
