TI-2024-01458 Aliases CVE-2024-1562 GHSA-wqjf-rx4g-qxmr

WooCommerce Google Sheet Connector <= 1.3.11 - Missing Authorization

LOW 30CWE-862Published 2024-02-21 · Updated 2026-04-08

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: None · Low · None
Fix status: No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

The WooCommerce Google Sheet Connector plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the execute_post_data function in all versions up to, and including, 1.3.11. This makes it possible for unauthenticated attackers to update plugin settings.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00428 37th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
WesternDeal	GSheetConnector for WooCommerce – Send your Orders and Products to Google Sheet in Real-Time	up to 1.3.11	—	No fix listed	CNA

GSheetConnector for WooCommerce – Send your Orders and Products to Google Sheet in Real-Time VendorWesternDeal Affected up to 1.3.11 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:gsheetconnector:woocommerce_google_sheet_connector::::::wordpress::*	before 1.3.12	Vulnerable	GSheetConnector

cpe:2.3:a:gsheetconnector:woocommerce_google_sheet_connector:*:*:*:*:*:wordpress:*:* Versions before 1.3.12 Vulnerable ·GSheetConnector

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2024-1562
2026-10-03 Alias added: GHSA-wqjf-rx4g-qxmr

References

Patch 1

https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3038517%40wc-gsheetconnector&new=3038517%40wc-gsheetconnector&sfp_email=&sfph_mail=

Advisory 1

https://www.wordfence.com/threat-intel/vulnerabilities/id/e36df7b7-fcbc-4e5d-812c-861bfe8abb55?source=cve

TI-2023-02190 Easy Digital Downloads Google Sheet Connector < 1.6.6 - Access Code Update via CSRF CVSS 3.1MEDIUM 5.4
TI-2025-41588 WordPress WPForms Google Sheet Connector plugin <= 4.0.1 - Remote Code Execution (RCE) vulnerability CVSS 3.1CRITICAL 9.9
TI-2013-05910 Directory traversal vulnerability in download-file.php in the Advanced Dewplayer plugin… CVSS 2.0MEDIUM 5.0
TI-2025-07870 Missing authorization in WesternDeal GSheetConnector for Gravity Forms – Send Gravity… CVSS 3.1HIGH 8.8
TI-2024-05250 CF7 Google Sheets Connector <= 5.0.9 - Missing Authorization to Limited Site Configuration Update CVSS 3.1MEDIUM 6.5
TI-2025-16634 WordPress GSheetConnector for Forminator Forms Plugin <= 1.0.12 - Reflected Cross Site Scripting (XSS) vulnerability CVSS 3.1HIGH 7.1

See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences