CVE-2024-13342 is a high severity (CVSS 8.1) arbitrary file upload in the Booster for WooCommerce plugin, through the add_files_to_order function, in versions up to and including 7.2.4. Double extension uploads may lead to code execution on some servers. Update past 7.2.4.
What's affected
- Booster for WooCommerce, all versions up to and including 7.2.4.
- The record says it is exploitable only on select configurations where the server executes the first extension present.
The record does not name a fixed version, but it links a code changeset. Check the plugin page for a release newer than 7.2.4.
How to check if you're exposed
Run the command below from the WordPress root with WP-CLI, or check the Plugins or Themes screen in the dashboard. Check staging, development and multisite networks too.
wp plugin list --format=table | grep -i booster
Compare the version shown to the affected range above. If you manage many sites, run the same check on each one.
What to do now
- Update Booster for WooCommerce to a release newer than 7.2.4.
- If you do not use the checkout file upload module, turn it off in the plugin settings.
- Check your uploads folder for files with unexpected double extensions, and block script execution in that folder at the web server.
- Look up CVE-2024-13342 on its Gold page to see the current details and any fix information.
- Scan your sites again after changes. Our free in-browser dependency scan covers package manifests such as package.json and requirements.txt, so use it for the build tooling around your site as well.
Why it matters
The weakness is missing file type validation in add_files_to_order. The attack complexity is rated high because exploitation depends on how the web server handles names such as file.php.jpg. On some setups the first extension decides, and the file is run as code.
The sibling CVE-2024-13744 hits a different function of the same plugin with the same class of flaw, so both are fixed by moving to the same newer release.
This CVE is an arbitrary file upload flaw (CWE-434, Unrestricted File Upload). Nothing in the record says it is exploited in the wild, and it is not marked as listed in CISA's Known Exploited Vulnerabilities catalog. That is a snapshot, so keep checking.
File upload handlers are risky because the server ends up storing something a stranger chose. If the handler does not check the file type properly, a file that the web server treats as code can end up in a web-reachable folder, and code that runs on your server is the start of a full compromise.
The usual defenses are an allowlist of file types checked on the server, renaming uploads, storing them outside the web root or with script execution turned off, and requiring authentication where possible. Double extension tricks work only on some server configurations, which is why the advisory language is conditional. The attack complexity is rated high for that reason.
Quick check
When is it exploitable?
The record says only on select instances where the configuration executes the first extension present.
Is CVE-2024-13744 the same bug?
No. It is a separate upload flaw in the same plugin.
Sources
Note: these pages could not be retrieved when this post was written, so statements rest on the CVE record text. Check the vendor pages for the latest version information.
Last reviewed: 19 October 2026.
