Read the docs
TI-2024-02653 Aliases CVE-2024-2843GHSA-xhpw-qr8c-jfj2

WooCommerce Customers Manager < 30.1 - User Deletion via CSRF

Priority MEDIUM 62CWE-352Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Tampering
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-352.

Summary

The WooCommerce Customers Manager WordPress plugin before 30.1 does not have CSRF checks in some places, which could allow attackers to make logged in admin users delete users via CSRF attacks

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00253 16th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA and NVD
Fix Fixed WooCommerce Customers Manager (Unknown): 30.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
UnknownWooCommerce Customers Managerbefore 30.130.1Patch availableCNA
  • WooCommerce Customers Manager VendorUnknown Affected before 30.1 Fixed in 30.1 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:vanquish:woocommerce_customers_manager:*:*:*:*:*:wordpress:*:*before 30.1Vulnerablevanquish
  • cpe:2.3:a:vanquish:woocommerce_customers_manager:*:*:*:*:*:wordpress:*:* Versions before 30.1 Vulnerable ·vanquish

Remediation

  • Fix · CNA WooCommerce Customers Manager (Unknown) Fixed in 30.1

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    WooCommerce Customers Manager 30.1

    2 records Highest priority Priority HIGH 1 HIGH, 1 MEDIUM

    Other records, highest priority first

    • TI-2024-03715 WooCommerce Customers Manager < 30.1 - Bulk Action via CSRFPriority HIGH 68
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-2843
  2. 2026-10-03 Alias added: GHSA-xhpw-qr8c-jfj2

References

Exploit 1

  • TI-2024-00361 WooCommerce Customers Manager < 29.7 - Subscriber+ SQL Injection CVSS 3.1HIGH 8.1
  • TI-2024-03715 WooCommerce Customers Manager < 30.1 - Bulk Action via CSRF CVSS 3.1HIGH 8.1
  • TI-2024-01625 WooCommerce Customers Manager < 30.2 - Subscriber+ Stored XSS CVSS 3.1MEDIUM 6.5
  • TI-2024-01621 WooCommerce Customers Manager < 29.8 - Reflected XSS CVSS 3.1MEDIUM 5.9
  • TI-2024-12386 WooCommerce Customers Manager <= 31.3 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation CVSS 3.1HIGH 8.8
  • TI-2024-01634 WooCommerce Customers Manager < 29.8 - Subscriber+ Email Disclosure CVSS 3.1MEDIUM 6.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences