CVE-2024-1756

WooCommerce Customers Manager < 29.8 - Subscriber+ Email Disclosure

The WooCommerce Customers Manager WordPress plugin before 29.8 does not have authorisation and CSRF in an AJAX action, allowing any authenticated users, such as subscriber, to call it and retrieve the list of customer email addresses along with their id, first name and last name

Affected

WooCommerce Customers Manager

CVSS v3.1 CNA

6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS

0.32% chance of exploitation in the next 30 days, 23rd percentile

Published

2024-04-24

Updated

2025-03-20

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/0baedd8d-2bbe-4091-bec4-f99e25d7290d/

Security advisories

• https://wpscan.com/vulnerability/0baedd8d-2bbe-4091-bec4-f99e25d7290d

References

• CVE Record
• NVD entry