{"schemaVersion":3,"id":"CVE-2022-4016","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"The Booster for WooCommerce WordPress plugin before 5.6.7, Booster Plus for WooCommerce WordPress plugin before 5.6.6, Booster Elite for WooCommerce WordPress plugin before 1.1.8 does not properly check for CSRF when creating and deleting Customer roles, allowing attackers to make logged admins create and delete arbitrary custom roles via CSRF attacks","dates":{"published":"2022-12-12T17:57:10.870Z","modified":"2025-04-22T14:41:03.625Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":6.5,"severity":"medium","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":6.5,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":6.5,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"wordfence","score":5.4,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00355,"percentile":0.27723,"severity":"low","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":0.017,"baselineDate":"2026-09-19T00:00:00.000Z","baselineScore":0.00338},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.00338,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.00338,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.00338,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.00338,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.00338,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00338,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00338,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00338,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00341,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00341,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00341,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00341,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00341,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00341,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00341,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00341,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00341,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00341,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00341,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00341,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00341,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00341,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00341,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00341,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00341,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00341,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00341,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00341,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00355,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00355,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00355,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00355,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00355,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00355,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00355,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00355,"percentile":0.27723}],"last30":[{"date":"2026-09-19T00:00:00.000Z","score":0.00338,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00338,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00338,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00341,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00341,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00341,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00341,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00341,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00341,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00341,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00341,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00341,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00341,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00341,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00341,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00341,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00341,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00341,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00341,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00341,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00341,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00341,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00341,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00355,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00355,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00355,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00355,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00355,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00355,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00355,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00355,"percentile":0.27723}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[{"id":"REF_40A6627E810803FA","name":"Exploit Reference (wpscan.com)","source":"reference","url":"https://wpscan.com/vulnerability/9b77044c-fd3f-4e6f-a759-dcc3082dcbd6","maturity":"unknown","reliabilityScore":0.2,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null}],"exploitCount":1,"weaknesses":[{"id":"CWE-352","name":"Cross-Site Request Forgery (CSRF)","description":"The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.","type":"weakness","status":"Stable","abstraction":"Compound","likelihoodOfExploit":"Medium","url":"https://cwe.mitre.org/data/definitions/352.html"}],"affected":[{"vendor":"booster","product":"booster_for_woocommerce","name":"booster for woocommerce","label":"booster_for_woocommerce","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 1.1.8","noFixRecorded":false,"fixedIn":null},{"text":"< 5.6.6","noFixRecorded":false,"fixedIn":null},{"text":"< 5.6.7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.1.8 | < 5.6.6 | < 5.6.7","eol":null,"hubHref":"/vendor/booster/booster_for_woocommerce"},{"vendor":"unknown","product":"booster elite for woocommerce","name":"Booster Elite for WooCommerce","label":"booster elite for woocommerce","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 1.1.8","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.1.8","eol":null,"hubHref":"/vendor/unknown/booster_elite_for_woocommerce"},{"vendor":"unknown","product":"booster for woocommerce","name":"Booster for WooCommerce","label":"booster for woocommerce","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 5.6.7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 5.6.7","eol":null,"hubHref":"/vendor/unknown/booster_for_woocommerce"},{"vendor":"unknown","product":"booster plus for woocommerce","name":"Booster Plus for WooCommerce","label":"booster plus for woocommerce","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 5.6.6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 5.6.6","eol":null,"hubHref":"/vendor/unknown/booster_plus_for_woocommerce"},{"vendor":"wordpress","product":"booster-elite-for-woocommerce","name":"Booster Elite for WooCommerce","label":"booster-elite-for-woocommerce","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 1.1.7 (fixed in 1.1.8)","noFixRecorded":false,"fixedIn":"1.1.8"}],"versionsText":"≤ 1.1.7 (fixed in 1.1.8)","eol":null,"hubHref":null},{"vendor":"wordpress","product":"booster-plus-for-woocommerce","name":"Booster Plus for WooCommerce","label":"booster-plus-for-woocommerce","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 5.6.5 (fixed in 5.6.6)","noFixRecorded":false,"fixedIn":"5.6.6"}],"versionsText":"≤ 5.6.5 (fixed in 5.6.6)","eol":null,"hubHref":null},{"vendor":"wordpress","product":"woocommerce-jetpack","name":"Booster for WooCommerce – PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools","label":"woocommerce-jetpack","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 5.6.6 (fixed in 5.6.7)","noFixRecorded":false,"fixedIn":"5.6.7"}],"versionsText":"≤ 5.6.6 (fixed in 5.6.7)","eol":null,"hubHref":null}],"affectedCount":7,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://wpscan.com/vulnerability/9b77044c-fd3f-4e6f-a759-dcc3082dcbd6","label":"wpscan.com/vulnerability/9b77044c-fd3f-4e6f-a759-dcc3082dcbd6","hostname":"wpscan.com","tags":["Exploit","VDB Entry","Technical Description","Third Party Advisory"]},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/21cc3f71-7591-4111-a58a-d863df74587f","label":"www.wordfence.com/threat-intel/vulnerabilities/id/21cc3f71-7591-4111-a58a-d863df74587f","hostname":"www.wordfence.com","tags":["Vendor Advisory"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2022-12-12T17:57:10.870Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2025-04-22T14:41:03.625Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":36,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T06:21:00.898Z","stale":false,"partial":false}}