CVE-2024-1747: 
WordPress vulnerability analysis and mitigation

The WooCommerce Customers Manager WordPress plugin before version 30.2 contains multiple security vulnerabilities related to authorization and CSRF in various AJAX actions. The vulnerability was discovered and publicly disclosed on July 11, 2024 (WPScan).

The vulnerability allows any authenticated users, including subscribers, to call various AJAX actions and update/delete/create customer metadata without proper authorization. The issue is compounded by a lack of CSRF protection and insufficient escaping of metadata values, which leads to Stored Cross-Site Scripting (XSS) vulnerabilities. The vulnerability has been assigned a CVSS score of 8.0 (high) and is classified under OWASP Top 10 A7: Cross-Site Scripting (XSS) and CWE-79 (WPScan).

When exploited, this vulnerability allows authenticated users to manipulate customer metadata and potentially execute stored XSS attacks that would be triggered when administrators view the affected customer metadata in the WordPress admin panel (WPScan).

A proof of concept exploit has been publicly disclosed. The exploit involves using fetch requests to the WordPress admin-ajax.php endpoint to update user metadata with malicious XSS payloads. The XSS payload is triggered when an administrator views the metadata for the affected user (WPScan).

The vulnerability has been fixed in version 30.2 of the WooCommerce Customers Manager plugin. Users are advised to update to this version or later to protect against these security issues (WPScan).