CVE-2024-1310 | THREATINT

Assigner	WPScan
Reserved	2024-02-07
Published	2024-04-15
Updated	2024-08-01

Description

The WooCommerce WordPress plugin before 8.6 does not prevent users with at least the contributor role from leaking products they shouldn't have access to. (e.g. private, draft and trashed products)

Problem types

CWE-284 Improper Access Control

Product status

Default status

unaffected

Any version before 8.6

affected

Credits

Scott Kingsley Clark 0x400549ee60

WPScan 0x400549ee70

References

https://wpscan.com/vulnerability/a7735feb-876e-461c-9a56-ea6067faf277/ exploit vdb-entry technical-description

cve.org CVE-2024-1310

nvd.nist.gov CVE-2024-1310

Download JSON

https://cve.threatint.com

Subscribe to our newsletter to learn more about our work.