Vulnerability record/PUBLISHED/Published Aug 1, 2024 06:00:02 UTC
CVE-2024-1747
The WooCommerce Customers Manager WordPress plugin before 30.2 does not have authorisation and CSRF in various AJAX actions, allowing any authenticated users, such as subscriber, to call them and update/delete/create customer metadata, also leading to Stored Cross-Site Scripting due to the lack of escaping of said metadata values.
Base score6.5/ 10
SeverityMediumCVSS 3.1
Exploitability / impact
CVSS metric breakdown
Base severityMedium
Attack vectorNetworkAV
Attack complexityLowAC
Privileges requiredLowPR
User interactionRequiredUI
ScopeChangedS
Confidentiality impactLowC
Integrity impactLowI
Availability impactLowA
CVSS vector string
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:LCVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.
Record context
CVE Numbering AuthorityWPScan
Last updatedAug 1, 2024 14:24:07 UTC
PublishedAug 1, 2024 06:00:02 UTC
ReservedFeb 22, 2024 14:14:40 UTC
Credits
- Erwan LR (WPScan)
- WPScan