CVE-2024-1756

2024-04-2405:15:47

WPScan

web.nvd.nist.gov

woocommerce

customers manager

wordpress

plugin

vulnerability

authorization

csrf

ajax action

authenticated users

subscriber

customer email addresses

first name

last name

AI Score

9.2

Confidence

High

EPSS

Percentile

9.0%

JSON

The WooCommerce Customers Manager WordPress plugin before 29.8 does not have authorisation and CSRF in an AJAX action, allowing any authenticated users, such as subscriber, to call it and retrieve the list of customer email addresses along with their id, first name and last name

Affected configurations

Vulners

Node

woocommercewoocommerce_customers_managerRange<29.8wordpress

VendorProductVersionCPE
woocommercewoocommerce_customers_manager*cpe:2.3:a:woocommerce:woocommerce_customers_manager:*:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
woocommerce	woocommerce_customers_manager	*	cpe:2.3:a:woocommerce:woocommerce_customers_manager::::::wordpress::*

CNA Affected

[
  {
    "vendor": "Unknown",
    "product": "WooCommerce Customers Manager",
    "versions": [
      {
        "status": "affected",
        "versionType": "semver",
        "version": "0",
        "lessThan": "29.8"
      }
    ],
    "defaultStatus": "unaffected"
  }
]