CVE-2024-13343: WooCommerce Customers Manager Privilege Escalation

CVE-2024-13343 Overview

CVE-2024-13343 is a privilege escalation vulnerability in the WooCommerce Customers Manager plugin for WordPress developed by Vanquish. The plugin fails to enforce a capability check on the ajax_assign_new_roles() function, allowing authenticated users with Subscriber-level access or higher to reassign their own role. Attackers can escalate directly to administrator, gaining full control over the affected WordPress site. The flaw affects all versions up to and including 31.3 and is tracked under CWE-269 and CWE-862.

Critical Impact
Any authenticated user, including default Subscribers, can promote themselves to administrator and take over the WordPress site.

Affected Products

Vanquish WooCommerce Customers Manager plugin for WordPress
All versions up to and including 31.3
WordPress installations running WooCommerce with the affected plugin enabled

Discovery Timeline

2025-02-01 - CVE-2024-13343 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-13343

Vulnerability Analysis

The WooCommerce Customers Manager plugin exposes an AJAX endpoint handled by the ajax_assign_new_roles() function. This function is intended for administrators to modify user roles across the WooCommerce customer base. The handler is registered through the standard WordPress wp_ajax_ action hook, making it callable by any authenticated user.

The function does not invoke current_user_can() or an equivalent capability check before applying role changes. As a result, a low-privileged user can submit a crafted AJAX request that reassigns their own account to the administrator role. Post-exploitation, the attacker inherits full administrative privileges over the WordPress instance, including plugin management, theme editing, and PHP code execution through the theme or plugin editor.

Root Cause

The root cause is a missing authorization check [CWE-862] combined with improper privilege management [CWE-269]. The ajax_assign_new_roles() handler assumes the caller is privileged based on the endpoint's intended admin-only usage. It never validates the current user's capabilities before mutating role data through wp_update_user() or a related WordPress API.

Attack Vector

Exploitation requires only network access to the WordPress site and any authenticated session at Subscriber level or above. Subscriber accounts are commonly self-registered on WooCommerce stores that allow customer signups, lowering the barrier substantially. An attacker sends a POST request to /wp-admin/admin-ajax.php with the action parameter targeting the vulnerable handler and a payload specifying their user ID and the administrator role. The server processes the request without verifying capabilities and commits the role change.

The vulnerability mechanism is described in the Wordfence Vulnerability Report. No public proof-of-concept exploit code is currently listed in the CVE record.

Detection Methods for CVE-2024-13343

Indicators of Compromise

Unexpected changes to the wp_usermeta table where meta_key = wp_capabilities for non-admin accounts now list administrator.
New or existing low-privileged user accounts that suddenly appear in the WordPress Users administration screen with the Administrator role.
POST requests to /wp-admin/admin-ajax.php with an action value referencing assign_new_roles originating from non-administrator sessions.
Installation of unfamiliar plugins, themes, or modifications to functions.php shortly after suspicious role changes.

Detection Strategies

Enable WordPress audit logging to capture role changes, plugin installations, and administrative actions with user attribution.
Correlate web server access logs for admin-ajax.php requests against authenticated session role at request time to identify privilege mismatches.
Baseline the count of administrator accounts and alert on deviations using file integrity or database monitoring tooling.

Monitoring Recommendations

Monitor authentication events for accounts whose privileges change without a corresponding admin-initiated workflow.
Track outbound network connections from the web host to detect follow-on webshell or backdoor activity after privilege escalation.
Ingest WordPress and web server logs into a centralized analytics platform for cross-source correlation and retention.

How to Mitigate CVE-2024-13343

Immediate Actions Required

Update the WooCommerce Customers Manager plugin to a version later than 31.3 as soon as the vendor publishes a fixed release.
Audit all WordPress user accounts and remove any administrator role assignments that cannot be attributed to a known administrator action.
Force a password reset for all accounts and invalidate active sessions to evict attackers that may already hold elevated privileges.
Review recently installed plugins, themes, and modified files for signs of persistence such as unknown PHP files in wp-content/uploads/.

Patch Information

At the time of publication, the CVE record does not list a specific fixed version. Refer to the Wordfence Vulnerability Report and the CodeCanyon Product Overview for vendor updates. Apply the patched release immediately once available.

Workarounds

Deactivate and remove the WooCommerce Customers Manager plugin until a patched version is available and verified.
Restrict access to /wp-admin/admin-ajax.php from unauthenticated or low-privileged sources using a web application firewall rule that blocks requests targeting the vulnerable action parameter.
Disable new user self-registration under WordPress Settings > General to reduce the pool of eligible Subscriber accounts.
Enforce multi-factor authentication on all accounts to raise the cost of acquiring the Subscriber-level foothold required for exploitation.

bash

# Example WAF rule concept: block ajax_assign_new_roles action for non-admins
# ModSecurity-style pseudo-rule
SecRule REQUEST_URI "@endsWith /wp-admin/admin-ajax.php" \
  "chain,deny,status:403,id:1013343,msg:'Block WooCommerce Customers Manager role assignment endpoint'"
  SecRule ARGS:action "@rx (?i)assign_new_roles"