Read the docs
TI-2024-01634 Aliases CVE-2024-1756GHSA-j23h-727c-9qvf

WooCommerce Customers Manager < 29.8 - Subscriber+ Email Disclosure

Priority LOW 29CWE-352Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Tampering
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-352.

Summary

The WooCommerce Customers Manager WordPress plugin before 29.8 does not have authorisation and CSRF in an AJAX action, allowing any authenticated users, such as subscriber, to call it and retrieve the list of customer email addresses along with their id, first name and last name

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00319 25th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA and NVD
Fix Fixed WooCommerce Customers Manager (Unknown): 29.8

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
UnknownWooCommerce Customers Managerbefore 29.829.8Patch availableCNA
  • WooCommerce Customers Manager VendorUnknown Affected before 29.8 Fixed in 29.8 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:vanquish:woocommerce_customers_manager:*:*:*:*:*:wordpress:*:*before 29.8Vulnerablevanquish
  • cpe:2.3:a:vanquish:woocommerce_customers_manager:*:*:*:*:*:wordpress:*:* Versions before 29.8 Vulnerable ·vanquish

Remediation

  • Fix · CNA WooCommerce Customers Manager (Unknown) Fixed in 29.8

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    WooCommerce Customers Manager 29.8

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2024-01621 WooCommerce Customers Manager < 29.8 - Reflected XSSPriority MEDIUM 60
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-1756
  2. 2026-10-03 Alias added: GHSA-j23h-727c-9qvf

References

Exploit 1

  • TI-2024-00361 WooCommerce Customers Manager < 29.7 - Subscriber+ SQL Injection CVSS 3.1HIGH 8.1
  • TI-2024-03715 WooCommerce Customers Manager < 30.1 - Bulk Action via CSRF CVSS 3.1HIGH 8.1
  • TI-2024-02653 WooCommerce Customers Manager < 30.1 - User Deletion via CSRF CVSS 3.1MEDIUM 6.5
  • TI-2024-01625 WooCommerce Customers Manager < 30.2 - Subscriber+ Stored XSS CVSS 3.1MEDIUM 6.5
  • TI-2024-01621 WooCommerce Customers Manager < 29.8 - Reflected XSS CVSS 3.1MEDIUM 5.9
  • TI-2024-12386 WooCommerce Customers Manager <= 31.3 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation CVSS 3.1HIGH 8.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences