CVE-2024-1310

MediumCVSS 4.9

Published: 15/04/2024(UTC)Updated: 20/07/2026(UTC)Translated: 21/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.68%

48th percentile - higher than 48% of all known CVEs

Summary

The WooCommerce WordPress plugin before version 8.6 fails to prevent users with at least the contributor role from leaking products they should not have access to, such as private, draft, and trashed products.

Risk Assessment

The risk involves unauthorized disclosure of sensitive product data, potentially leading to leakage of business information or privacy breaches.

Recommendation

It is recommended to immediately update the WooCommerce plugin to version 8.6 or later, which fixes this vulnerability.

Original NVD description (English source)

The WooCommerce WordPress plugin before 8.6 does not prevent users with at least the contributor role from leaking products they shouldn't have access to. (e.g. private, draft and trashed products)