WooCommerce Customers Manager SQL injection

Technical summary

WooCommerce Customers Manager extends WooCommerce with customer administration features. A request parameter reaches an SQL statement without being sanitised or escaped.

The published description puts the bar at the Subscriber role and above. On a WooCommerce shop that is effectively any registered customer, which is what makes this one of the higher-scored entries on this index.

Impact

A customer-level account can read and alter data across the shop database, including other customers’ records and order history.

The WooCommerce Customers Manager WordPress plugin before 29.7 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to an SQL injection exploitable by Subscriber+ role.

Remediation

WPScan records the issue as fixed in version 29.7.

Disclosure timeline

1. 2024-03-25WPScan advisory published
2. 2024-04-15CVE record published

Only publicly documented dates are shown. Where a step in the process was not published, it is not listed.

References

• NVD entry
• CVE record (MITRE)
• WPScan advisory

We publish advisories, not exploits. Each entry describes the vulnerability class and impact at the level the vendor advisory does, and links to the authoritative records. Where public proof-of-concept code exists we link to it rather than reproduce it.