CVE-2024-3957 is a medium severity flaw in the Booster for WooCommerce WordPress plugin, scored 6.5 by NVD. Versions up to and including 7.1.8 let unauthenticated visitors run arbitrary shortcodes. Update to a release newer than 7.1.8 and confirm the first fixed version in the plugin changelog.
What's affected
The record names Booster for WooCommerce in versions up to and including 7.1.8. It describes unauthenticated arbitrary shortcode execution, and adds that the severity and exploitability depend on what other plugins are installed and what shortcode functionality they provide.
That last point is why the score is only medium. The plugin gives the attacker a way to call shortcodes, and the harm comes from the shortcodes already on your site. A site with few shortcode plugins has little exposed. A site with plugins that expose data, forms or file operations as shortcodes has more.
The record does not state a fixed version. It links the plugin source and a code changeset. The KEV flag is false and no exploitation is reported.
The NVD record is dated 2024-05-02 and carries the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L, a score of 6.5 (Medium). Weakness class: CWE-94, CWE-863.
How to check if you're exposed
Check the plugin version in the WordPress admin, or with WP-CLI.
wp plugin list --name=woocommerce-jetpack --fields=name,version,status
The plugin directory name in the changeset link is woocommerce-jetpack, which is the slug Booster uses in the WordPress repository. A version of 7.1.8 or lower is affected.
Then review the shortcodes your other plugins register, because they define the real exposure. WP-CLI can list the registered shortcodes.
wp shortcode list
Any shortcode that returns private data or performs an action deserves a closer look.
What to do now
- Update Booster for WooCommerce to a release newer than 7.1.8.
- Check the Booster changelog or the linked changeset for the exact fixed version.
- List the shortcodes your site registers and remove plugins that you no longer use.
- Review web logs for requests that pass shortcode text to public endpoints.
- Keep the plugin on automatic updates if your change process allows it.
Why it matters
The record classes the flaw as code injection, CWE-94, and incorrect authorization, CWE-863. A public code path accepted text that WordPress then ran as shortcodes, with no check on who was asking.
This is a good example of a chained risk. The plugin bug alone is moderate, but it widens the reach of every other plugin on the site. Knowing which plugins are installed and what they expose is what turns a generic score into a real priority for your own site.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Why is this only a medium score?
Because the impact depends on what other plugins offer as shortcodes. The record says severity and exploitability depend on the plugins installed.
Is there a fixed version?
The record does not give one. Check the plugin changelog and the linked changeset.
Sources
Last reviewed: 19 October 2026.
