high8.1Public exploit code
CVE-2024-0399
The WooCommerce Customers Manager WordPress plugin before 29.7 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- WooCommerce Customers Manager 29.4 - Post-Authenticated SQL Injection2025-04-16 · webapps · multiple
Impact
The WooCommerce Customers Manager WordPress plugin before 29.7 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to an SQL injection exploitable by Subscriber+ role.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Vanquish | Woocommerce Customers Manager | before 29.7 |