The WooCommerce Customers Manager WordPress plugin before 29.8 does not have authorisation and CSRF in an AJAX action, allowing any authenticated users, such as subscriber, to call it and retrieve the list of customer email addresses along with their id, first name and last name
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Woocommerce Customers Manager Plugin | — | Update woocommerce-customers-manager plugin to version 29.8, or a newer patched version | May 15, 2025 | Apr 2, 2024 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub