CVE-2024-0399

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

The WooCommerce Customers Manager WordPress plugin before 29.7 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to an SQL injection exploitable by Subscriber+ role.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
Unknown	WooCommerce Customers Manager	< 29.7
woocommerce	woocommerce_customers_manager	< 29.7

References

https://wpscan.com/vulnerability/1550e30c-bf80-48e0-bc51-67d29ebe7272/Exploit, Third Party Advisory
https://wpscan.com/vulnerability/1550e30c-bf80-48e0-bc51-67d29ebe7272/Exploit, Third Party Advisory

Timeline

Published: Apr 15, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-04007.5SCM Software is a client and server application. An Authenticated System manager client can execute LINQ query in the SCM server, for custom CVE-2024-04017.2ASUS routers supporting custom OpenVPN profiles are vulnerable to a code execution vulnerability. An authenticated and remote attacker can e CVE-2024-04029.9An issue has been discovered in GitLab CE/EE affecting all versions from 16.0 prior to 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.CVE-2024-04036.5Recipes version 1.5.10 allows arbitrary HTTP requests to be made through the server. This is possible because the application is vulnerabl CVE-2024-04049.1A mass assignment vulnerability exists in the `/api/invite/:code` endpoint of the mintplex-labs/anything-llm repository, allowing unauthoriz CVE-2024-04056.5The Burst Statistics – Privacy-Friendly Analytics for WordPress plugin, version 1.5.3, is vulnerable to Post-Authenticated SQL Injection via CVE-2024-04067.8A flaw was discovered in the mholt/archiver package. This flaw allows an attacker to create a specially crafted tar file, which, when unpack CVE-2024-04076.5Certain HP Enterprise LaserJet, and HP LaserJet Managed Printers are potentially vulnerable to information disclosure, when connections made CVE-2024-04085.5A flaw was found in the X.Org server. The GLX PBuffer code does not call the XACE hook when creating the buffer, leaving it unlabeled. When CVE-2024-04097.8A flaw was found in the X.Org server. The cursor code in both Xephyr and Xwayland uses the wrong type of private at creation. It uses the cu CVE-2024-04107.7An authorization bypass vulnerability was discovered in GitLab affecting versions 15.1 prior to 16.7.6, 16.8 prior to 16.8.3, and 16.9 prior CVE-2024-04117.5A vulnerability was found in DeShang DSMall up to 6.1.0. It has been classified as problematic. This affects an unknown part of the file pub