CVE-2024-0399 WooCommerce Customers Manager < 29.7 - Subscriber+ SQL Injection

2024-04-1505:00:01

WPScan

github.com

woocommerce

customers manager

sql injection

AI Score

Confidence

High

SSVC

Exploitation

poc

Automatable

Technical Impact

total

JSON

The WooCommerce Customers Manager WordPress plugin before 29.7 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to an SQL injection exploitable by Subscriber+ role.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:woocommerce:woocommerce_customers_manager:*:*:*:*:*:*:*:*"
    ],
    "vendor": "woocommerce",
    "product": "woocommerce_customers_manager",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "29.7",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]