WooCommerce Customers Manager Plugin Vulnerable to Authorization Bypass and Stored Cross-Site Scripting
CVE-2024-1747
Currently unrated
What is CVE-2024-1747?
The WooCommerce Customers Manager WordPress plugin before 30.2 does not have authorisation and CSRF in various AJAX actions, allowing any authenticated users, such as subscriber, to call them and update/delete/create customer metadata, also leading to Stored Cross-Site Scripting due to the lack of escaping of said metadata values.
Affected Version(s)
WooCommerce Customers Manager 0 < 30.2
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.