The Booster Elite for WooCommerce plugin allows an authenticated user to retrieve arbitrary WordPress options, potentially exposing sensitive data such as FTP credentials, SSL keys, or other configuration values. Once accessed, an attacker can exploit this information to compromise downstream systems or services. The vulnerability is not a remote code execution flaw, but it facilitates a breach of confidentiality for any administrator who can log into the site.

WordPress sites using the Pluggabl LLC Booster Elite for WooCommerce plugin with versions earlier than 8.4.0 are affected. Versions 8.4.0 and newer contain the fix.

The CVSS score of 6.5 indicates medium severity. Because exploitation requires authentication, the likelihood depends on how many users have privileged access and how well those credentials are protected. No exploit has been reported and EPSS is not available at this time, and the vulnerability is not listed in the KEV catalog. Attackers would typically send a crafted request through the site’s admin interface after authenticating with valid credentials to retrieve the protected options.