WooCommerce Customers Manager 29.4: Watch Out for SQL Shenanigans!
WooCommerce Customers Manager users, brace yourselves! A post-authenticated SQL injection vulnerability is lurking in version 29.4, ready to cause mischief. If you’re feeling brave, try injecting SQL commands into transaction amount parameters and watch as chaos ensues. But seriously, update your plugin faster than a caffeine-fueled squirrel! CVE-2024-0399, we’re looking at you.
Hot Take:
It’s like leaving the vault door open after closing time! WooCommerce Customers Manager’s latest act? Giving subscribers a magical key to the SQL kingdom! Time to grab the popcorn, because even your database might be having a sleepless night.
Key Points:
- WooCommerce Customers Manager version 29.4 is vulnerable to SQL injection.
- The issue arises from improper sanitization of transaction amount parameters.
- Exploitable by users with Subscriber+ role through the admin AJAX endpoint.
- The vulnerability is time-based, with server responses delayed by injected commands.
- Users are urged to update the plugin once a patch is available and restrict endpoint access.
Already a member? Log in here