CVE-2026-56027: WordPress Booster for WooCommerce plugin <= 8.0.1 - Arbitrary File Upload vulnerability

Synopsis

An arbitrary file upload vulnerability affects the Booster for WooCommerce WordPress plugin at version 8.0.1 and earlier. The flaw is reachable over the network and requires only a low-privilege (customer-level) account, with no additional user interaction needed. Successful exploitation allows an attacker to upload malicious files to the server, enabling remote code execution, full data disclosure, and complete integrity compromise of the affected environment. No upstream fix has been published yet; HarborGuard is tracking the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, meaning an attacker can reach it from any internet-connected host without requiring local or physical access.

• AuthenticationRequired

  A low-privilege account (such as a standard WooCommerce customer account) is sufficient; no administrative credentials are needed.

• Victim interactionNot required

  The attacker does not need to trick or involve any other user to complete the exploit.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special race conditions, memory layout knowledge, or other environmental prerequisites.

Blast Radius

• An attacker uploads a malicious file (such as a PHP web shell) to the server and executes arbitrary operating system commands.
• All data stored in the WordPress database, including customer records, order details, and session tokens, becomes readable.
• An attacker can modify or delete database rows, plugin files, and uploaded content, corrupting site integrity.
• The attacker can crash or deny service to the WordPress application by overwriting critical files or exhausting server resources.