The WooCommerce Customers Manager WordPress plugin before 29.7 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to an SQL injection exploitable by Subscriber+ role.
CVSS
No CVSS.
References
| Link | Resource |
|---|---|
| https://wpscan.com/vulnerability/1550e30c-bf80-48e0-bc51-67d29ebe7272/ | Exploit Third Party Advisory |
| https://wpscan.com/vulnerability/1550e30c-bf80-48e0-bc51-67d29ebe7272/ | Exploit Third Party Advisory |
Configurations
History
07 Apr 2025, 14:48
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Vanquish woocommerce Customers Manager
Vanquish |
|
| CPE | cpe:2.3:a:vanquish:woocommerce_customers_manager:*:*:*:*:*:wordpress:*:* | |
| References | () https://wpscan.com/vulnerability/1550e30c-bf80-48e0-bc51-67d29ebe7272/ - Exploit, Third Party Advisory | |
| CWE | CWE-89 |
15 Apr 2024, 05:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-04-15 05:15
Updated : 2025-04-07 14:48
NVD link : CVE-2024-0399
Mitre link : CVE-2024-0399
JSON object : View
Products Affected
vanquish
- woocommerce_customers_manager
CWE
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')