Read the docs
TI-2024-03715 Aliases CVE-2024-3983GHSA-f8wm-p3c6-g898

WooCommerce Customers Manager < 30.1 - Bulk Action via CSRF

Priority HIGH 68CWE-352Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Tampering
Confidentiality · integrity · availability
High · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-352.

Summary

The WooCommerce Customers Manager WordPress plugin before 30.1 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting customers via CSRF attacks

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00312 24th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA and NVD
Fix Fixed WooCommerce Customers Manager (Unknown): 30.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
UnknownWooCommerce Customers Managerbefore 30.130.1Patch availableCNA
  • WooCommerce Customers Manager VendorUnknown Affected before 30.1 Fixed in 30.1 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:vanquish:woocommerce_customers_manager:*:*:*:*:*:wordpress:*:*before 30.1Vulnerablevanquish
  • cpe:2.3:a:vanquish:woocommerce_customers_manager:*:*:*:*:*:wordpress:*:* Versions before 30.1 Vulnerable ·vanquish

Remediation

  • Fix · CNA WooCommerce Customers Manager (Unknown) Fixed in 30.1

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    WooCommerce Customers Manager 30.1

    2 records Highest priority Priority HIGH 1 HIGH, 1 MEDIUM

    Other records, highest priority first

    • TI-2024-02653 WooCommerce Customers Manager < 30.1 - User Deletion via CSRFPriority MEDIUM 62
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-3983
  2. 2026-10-03 Alias added: GHSA-f8wm-p3c6-g898

References

Exploit 1

  • TI-2024-00361 WooCommerce Customers Manager < 29.7 - Subscriber+ SQL Injection CVSS 3.1HIGH 8.1
  • TI-2024-02653 WooCommerce Customers Manager < 30.1 - User Deletion via CSRF CVSS 3.1MEDIUM 6.5
  • TI-2024-01625 WooCommerce Customers Manager < 30.2 - Subscriber+ Stored XSS CVSS 3.1MEDIUM 6.5
  • TI-2024-01621 WooCommerce Customers Manager < 29.8 - Reflected XSS CVSS 3.1MEDIUM 5.9
  • TI-2024-12386 WooCommerce Customers Manager <= 31.3 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation CVSS 3.1HIGH 8.8
  • TI-2024-01634 WooCommerce Customers Manager < 29.8 - Subscriber+ Email Disclosure CVSS 3.1MEDIUM 6.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences