CVE-2024-34370 HIGH

CVE-2024-34370: WordPress EAN for WooCommerce plugin <= 4.8.9 - Arbitrary Option Update to Privilege Escalation vulnerability

Vendor Wpfactory
Product EAN for WooCommerce
Weakness CWE-269
Published May 17, 2024
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

7.2/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Improper Privilege Management vulnerability in WPFactory EAN for WooCommerce allows Privilege Escalation.This issue affects EAN for WooCommerce: from n/a through 4.8.9.

Explanation of Vulnerability in Simple Terms

02Summary

EAN for WooCommerce versions up to 4.8.9 contain a privilege management flaw that allows high-privileged users to read sensitive data, modify site content, or disrupt service. The vulnerability requires administrator-level access to exploit. Site owners should update to a version newer than 4.8.9 immediately.

What an attacker can do

03Attacker Capabilities

An administrator can read sensitive data, modify content, or disrupt the site's availability.

Potential impact on your site

04Site Impact

Compromised admin accounts can cause data breaches, content tampering, or service outages.

Conditions required to exploit

05Prerequisites

Attacker must have administrator-level access to the WordPress site.

Key dates

06Disclosure timeline

May 17, 2024 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-2931 Amelia Booking <= 9.1.2 - Authenticated (Customer+) Insecure Direct Object Reference to Arbitrary User Password Change CVE-2026-7284 Easy Elements for Elementor <= 1.4.4 - Unauthenticated Privilege Escalation via easyel_handle_register CVE-2026-8809 Advanced Custom Fields: Extended <= 0.9.2.5 - Unauthenticated Privilege Escalation via Validation Bypass to '_acf_post_id' Parameter CVE-2026-5193 Essential Addons for Elementor – Popular Elementor Templates & Widgets <= 6.5.13 - Authenticated (Author+) Limited Privilege Escalation via register_user CVE-2026-12415 Invoice Generator <= 1.0.0 - Unauthenticated Privilege Escalation via Account Takeover via 'user_id' Parameter