High severity8.8NVD Advisory· Published Feb 1, 2025· Updated Jun 17, 2026
CVE-2024-13343
CVE-2024-13343
Description
The WooCommerce Customers Manager plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the ajax_assign_new_roles() function in all versions up to, and including, 31.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges to that of an administrator.
Affected products
4<=31.3+ 1 more
- (no CPE)range: <=31.3
- (no CPE)
0+ 1 more
- (no CPE)range: 0
- cpe:2.3:a:vanquish:woocommerce_customers_manager:*:*:*:*:*:wordpress:*:*range: <31.4
Patches
Vulnerability mechanics
References
2News mentions
0No linked articles in our index yet.