CVE-2024-1756: WooCommerce Customers Manager < 29.8 - Subscriber+ Email Disclosure
The WooCommerce Customers Manager WordPress plugin before 29.8 does not have authorisation and CSRF in an AJAX action, allowing any authenticated users, such as subscriber, to call it and retrieve the list of customer email addresses along with their id, first name and last name
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-1756?
CVE-2024-1756 has a high severity rating due to the potential unauthorized access to sensitive customer information.
How do I fix CVE-2024-1756?
To fix CVE-2024-1756, update the WooCommerce Customers Manager plugin to version 29.8 or later.
What are the consequences of CVE-2024-1756?
The consequences of CVE-2024-1756 include the unauthorized retrieval of customer email addresses and personal data by authenticated users.
Who is affected by CVE-2024-1756?
Any WooCommerce Customers Manager users running versions prior to 29.8 are affected by CVE-2024-1756.
Is there a workaround for CVE-2024-1756?
Currently, the recommended solution for CVE-2024-1756 is to apply the available update rather than seeking a temporary workaround.