CVE-2024-2843

CWE-352 — Cross-Site Request Forgery (CSRF)3 documents3 sources

Severity

6.5MEDIUM

EPSS

0.1%

top 67.01%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Unknown Woocommerce Customers Manager Vanquish Woocommerce Customers Manager

Timeline

PublishedAug 1

Description

The WooCommerce Customers Manager WordPress plugin before 30.1 does not have CSRF checks in some places, which could allow attackers to make logged in admin users delete users via CSRF attacks

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages2 packages

▶CVEListV5unknown/woocommerce_customers_manager< 30.1

▶NVDvanquish/woocommerce_customers_manager< 30.1

🔴Vulnerability Details

CVEList

WooCommerce Customers Manager < 30.1 - User Deletion via CSRF↗2024-08-01

▶

GHSA

GHSA-xhpw-qr8c-jfj2: The WooCommerce Customers Manager WordPress plugin before 30↗2024-08-01

▶