CVE-2024-1756

MEDIUM

WooCommerce Customers Manager < 29.8 - Authenticated Information Disclosure via AJAX Action

Title source: llm
STIX 2.1

Description

The WooCommerce Customers Manager WordPress plugin before 29.8 does not have authorisation and CSRF in an AJAX action, allowing any authenticated users, such as subscriber, to call it and retrieve the list of customer email addresses along with their id, first name and last name

References (1)

Core 1
Core References
Exploit, Third Party Advisory exploit vdb-entry technical-description
https://wpscan.com/vulnerability/0baedd8d-2bbe-4091-bec4-f99e25d7290d/

Scores

CVSS v3 6.5
EPSS 0.0032
EPSS Percentile 23.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-352
Status published
Products (1)
vanquish/woocommerce_customers_manager < 29.8
Published Apr 24, 2024
Tracked Since Feb 18, 2026