Cyber Resilience

CVE-2024-1310

MediumPublic PoC

Published: 15 April 2024

Published
15 April 2024
Modified
27 May 2025
KEV Added
—
Patch
—
CVSS Score v3.1 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
EPSS Score 0.0055 68.5th percentile
Risk Priority 10 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-1310 is a medium-severity an unspecified weakness vulnerability in Automattic Woocommerce. Its CVSS base score is 4.9 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Data from Information Repositories (T1213); ranked in the top 31.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

EU & UK References

Vulnerability details

The WooCommerce WordPress plugin before 8.6 does not prevent users with at least the contributor role from leaking products they shouldn't have access to. (e.g. private, draft and trashed products)

CWE(s)
NVD-CWE-noinfo

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1213 Data from Information Repositories Collection
Adversaries may leverage information repositories to mine valuable information.
attack.mitre.org →
Why these techniques?

The vulnerability enables low-privileged authenticated users (contributor+) to bypass access controls and collect unauthorized data from the WooCommerce product repository (private, draft, trashed, and hidden products) using shortcodes.

Affected Assets

automattic
woocommerce
≤ 8.6

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References