CVE-2024-1756

2024-04-2405:15:47

[email protected]

web.nvd.nist.gov

woocommerce

customers manager

wordpress

plugin

vulnerability

authorization

csrf

ajax action

authenticated users

subscriber

customer email addresses

first name

last name

9.2 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

8.9%

JSON

The WooCommerce Customers Manager WordPress plugin before 29.8 does not have authorisation and CSRF in an AJAX action, allowing any authenticated users, such as subscriber, to call it and retrieve the list of customer email addresses along with their id, first name and last name

Affected configurations

Vulners

Node

piwebsolutionexport_customers_list_csv_for_woocommerceRange<29.8

VendorProductVersionCPE
piwebsolutionexport_customers_list_csv_for_woocommerce*cpe:2.3:a:piwebsolution:export_customers_list_csv_for_woocommerce:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
piwebsolution	export_customers_list_csv_for_woocommerce	*	cpe:2.3:a:piwebsolution:export_customers_list_csv_for_woocommerce::::::::

CNA Affected

[
  {
    "vendor": "Unknown",
    "product": "WooCommerce Customers Manager",
    "versions": [
      {
        "status": "affected",
        "versionType": "semver",
        "version": "0",
        "lessThan": "29.8"
      }
    ],
    "defaultStatus": "unaffected"
  }
]