CVE-2024-1310
MediumCVSS 4.9Exploitation Probability (EPSS)
Low risk48th percentile - higher than 48% of all known CVEs
Summary
The WooCommerce WordPress plugin before version 8.6 fails to prevent users with at least the contributor role from leaking products they should not have access to, such as private, draft, and trashed products.
Risk Assessment
The risk involves unauthorized disclosure of sensitive product data, potentially leading to leakage of business information or privacy breaches.
Recommendation
It is recommended to immediately update the WooCommerce plugin to version 8.6 or later, which fixes this vulnerability.
Other vulnerabilities in WooCommerce
See all- CVE-2022-50972Critical
WooCommerce version 7.1.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary PHP code by injecting shell commands through the product-type parameter.
- CVE-2026-54807Critical
There is an unauthenticated privilege escalation vulnerability in the registration form for WooCommerce versions <= 1.0.9.
- CVE-2026-42386Critical
WooCommerce versions up to 4.5.1 contain a vulnerability for unauthenticated SQL injection in the order delivery date field.
- CVE-2026-48888High
Resource exhaustion vulnerability without limits or throttling in Automattic WooCommerce allows HTTP DoS. This affects WooCommerce versions before 11.1.0.
- CVE-2026-57777High
WooCommerce plugin by Automattic contains a Blind SQL Injection vulnerability due to improper neutralization of special elements in SQL commands. Affects versions before 11.0.
- CVE-2026-49110High
In WooCommerce versions up to 3.1.4, there is a vulnerability of unauthenticated broken authentication in the Upsell Order Bump Offer feature.
Original NVD description (English source)
The WooCommerce WordPress plugin before 8.6 does not prevent users with at least the contributor role from leaking products they shouldn't have access to. (e.g. private, draft and trashed products)
Vulnerability data from NVD (NIST) · CISA KEV · EPSS