CVE-2024-31276 MEDIUM

CVE-2024-31276: WordPress Products, Order & Customers Export for WooCommerce plugin <= 2.0.8 - Broken Access Control vulnerability

Vendor Wpfactory
Product Products, Order & Customers Export for WooCommerce
Weakness CWE-862 · Missing authorization
Published June 9, 2024
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

5.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality Low
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

What the vulnerability does

01Description

Missing Authorization vulnerability in WPFactory Products, Order & Customers Export for WooCommerce.This issue affects Products, Order & Customers Export for WooCommerce: from n/a through 2.0.8.

Explanation of Vulnerability in Simple Terms

02Summary

The Products, Order & Customers Export for WooCommerce plugin through version 2.0.8 does not properly check user permissions before allowing access to export functionality. An unauthenticated attacker can read sensitive customer and order data by directly accessing the export feature without logging in. This exposes names, email addresses, purchase history, and other business-critical information.

What an attacker can do

03Attacker Capabilities

Read exported customer names, email addresses, order details, and other sensitive WooCommerce data without logging in.

Potential impact on your site

04Site Impact

Customer and order data can be downloaded by anyone, exposing privacy and creating compliance risk.

Conditions required to exploit

05Prerequisites

Network access to the site; no authentication or user interaction required.

Key dates

06Disclosure timeline

June 9, 2024 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-57335 WordPress Ads by WPQuads plugin <= 3.0.3 - Broken Access Control vulnerability CVE-2026-39448 WordPress NOWPayments for WooCommerce plugin <= 1.4.0 - Broken Access Control vulnerability CVE-2026-12133 JoomSport <= 5.7.8 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Group Deletion via season_groupdel AJAX action CVE-2026-12349 Premium Addons for KingComposer <= 1.1.1 - Missing Authorization to Unauthenticated Arbitrary Custom Sidebar Creation and Deletion via 'add_custom_sidebar' and 'remove_custom_sidebar' AJAX actions CVE-2026-27433 WordPress Motors theme <= 5.6.80 - Broken Access Control vulnerability