What is the severity of CVE-2024-13747?

CVE-2024-13747 is considered a high-severity vulnerability due to the potential for unauthorized data loss.

How do I fix CVE-2024-13747?

To fix CVE-2024-13747, update the WooMail - WooCommerce Email Customizer plugin to version 3.0.35 or later.

What versions are affected by CVE-2024-13747?

All versions of the WooMail - WooCommerce Email Customizer plugin up to and including 3.0.34 are affected by CVE-2024-13747.

Who can exploit CVE-2024-13747?

Authenticated attackers can exploit CVE-2024-13747 due to the lack of a capability check on certain functions.

What damage can CVE-2024-13747 cause?

CVE-2024-13747 can lead to unauthorized deletion of saved email templates, resulting in potential data loss for users.

Vulnerability/
CVE-2024-13747

medium

4.3

CWE

862

5/3/2025

CVE-2024-13747: WooMail - WooCommerce Email Customizer <= 3.0.34 - Authenticated (Subscriber+) Missing Authorization to SQL Injection

First published: Wed Mar 05 2025(Updated: )

The WooMail - WooCommerce Email Customizer plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'template_delete_saved' function in all versions up to, and including, 3.0.34. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject SQL into an existing post deletion query.

Credit: security@wordfence.com

Affected Software	Affected Version	How to fix
ThemeHigh Email Customizer for WooCommerce	<=3.0.34

Never miss a vulnerability like this again

Reference Links

Frequently Asked Questions

What is the severity of CVE-2024-13747?
CVE-2024-13747 is considered a high-severity vulnerability due to the potential for unauthorized data loss.
How do I fix CVE-2024-13747?
To fix CVE-2024-13747, update the WooMail - WooCommerce Email Customizer plugin to version 3.0.35 or later.
What versions are affected by CVE-2024-13747?
All versions of the WooMail - WooCommerce Email Customizer plugin up to and including 3.0.34 are affected by CVE-2024-13747.
Who can exploit CVE-2024-13747?
Authenticated attackers can exploit CVE-2024-13747 due to the lack of a capability check on certain functions.
What damage can CVE-2024-13747 cause?
CVE-2024-13747 can lead to unauthorized deletion of saved email templates, resulting in potential data loss for users.

agent/weakness
agent/title
agent/type
agent/first-publish-date
agent/references
agent/description
agent/softwarecombine
collector/nvd-api
source/NVD
agent/author
agent/source
agent/severity
agent/event
agent/tags
collector/mitre-cve
source/MITRE
agent/last-modified-date
agent/guess-ai
agent/software-canonical-lookup
agent/software-canonical-lookup-request
vendor/woocommerce
canonical/themehigh email customizer for woocommerce

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.