CVE-2024-1562: WooCommerce Google Sheet Connector Bypass

CVE-2024-1562 Overview

CVE-2024-1562 affects the WooCommerce Google Sheet Connector plugin for WordPress. The vulnerability stems from a missing capability check on the execute_post_data function in all versions up to and including 1.3.11. Unauthenticated attackers can invoke this function over the network to modify plugin settings without any authentication or user interaction.

The flaw is classified as Missing Authorization [CWE-862]. It affects the integrity of plugin configuration data but does not directly expose confidential information or disrupt availability.

Critical Impact
Unauthenticated attackers can update plugin settings remotely, potentially redirecting WooCommerce order data to attacker-controlled Google Sheets or disabling the integration entirely.

Affected Products

WooCommerce Google Sheet Connector plugin for WordPress
All versions up to and including 1.3.11
WordPress sites running WooCommerce with the affected plugin installed

Discovery Timeline

2024-02-21 - CVE-2024-1562 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-1562

Vulnerability Analysis

The WooCommerce Google Sheet Connector plugin exposes an AJAX-accessible handler named execute_post_data. This handler processes plugin configuration updates but omits a WordPress capability check such as current_user_can() and does not validate a nonce token tied to an authenticated session.

Because the endpoint is reachable without authentication, any remote actor able to send an HTTP request to the WordPress site can trigger the settings update path. The vulnerability requires no user interaction and no privileges, and it can be exploited across the network against default installations.

Exploitation impacts integrity of the plugin's configuration. An attacker can alter destination sheet identifiers, credentials mapping, or synchronization behavior. Confidentiality and availability are not directly affected by the primary defect.

Root Cause

The root cause is Broken Access Control [CWE-862]. The execute_post_data function assumes callers are already authorized administrators. It never verifies the caller's WordPress role or capability, and it does not enforce a check_ajax_referer nonce validation before processing incoming parameters.

Attack Vector

An attacker sends a crafted HTTP POST request to the WordPress AJAX endpoint that routes to execute_post_data. The request carries the fields the attacker wishes to overwrite in the plugin's stored options. No session cookie, API key, or CSRF token is required for the server to accept the write.

No public proof-of-concept exploit or CISA KEV listing is associated with this vulnerability. See the Wordfence Vulnerability Report for additional technical context.

Detection Methods for CVE-2024-1562

Indicators of Compromise

Unexpected changes to WooCommerce Google Sheet Connector plugin options in the wp_options table
Google Sheet destination IDs or account bindings that differ from administrator-configured values
POST requests to admin-ajax.php referencing the execute_post_data action from unauthenticated sources
Absence of an authenticated wp_user session cookie on requests that modified plugin settings

Detection Strategies

Review WordPress access logs for POST requests to wp-admin/admin-ajax.php containing the vulnerable action parameter, correlated with anonymous source IPs
Compare current plugin settings against a known-good baseline stored outside the WordPress database
Enable WordPress audit logging plugins to capture option changes and administrator activity for the affected plugin

Monitoring Recommendations

Alert on any modification to WooCommerce Google Sheet Connector option rows in wp_options that is not preceded by an authenticated administrator login
Monitor outbound traffic from the WordPress host to unfamiliar Google Sheets API endpoints or unexpected sheet IDs
Rate-limit and log requests to admin-ajax.php at the web application firewall (WAF) layer to surface anonymous callers targeting plugin actions

How to Mitigate CVE-2024-1562

Immediate Actions Required

Update the WooCommerce Google Sheet Connector plugin to a version later than 1.3.11 that includes the capability check fix
Audit current plugin settings and restore any values that were changed without authorization
Rotate any Google service account credentials or OAuth tokens bound to the plugin if unauthorized settings changes are detected
Restrict administrative endpoints such as admin-ajax.php behind a WAF rule set that inspects for the vulnerable action parameter

Patch Information

The vendor addressed the missing capability check in a subsequent release published through the WordPress plugin repository. The upstream fix is documented in the WordPress Plugin Changeset. Site owners should apply the update through the WordPress admin dashboard or automated update tooling.

Workarounds

Deactivate the WooCommerce Google Sheet Connector plugin until the patched version is installed if immediate updating is not feasible
Block unauthenticated requests to admin-ajax.php with the affected action name using a WAF or reverse proxy rule
Restrict access to the WordPress admin surface by source IP where operationally practical

bash

# Example WAF rule to block unauthenticated requests targeting the vulnerable action
# Adjust for your specific WAF syntax (ModSecurity example)
SecRule REQUEST_URI "@endsWith /wp-admin/admin-ajax.php" \
    "chain,deny,status:403,id:1000562,msg:'Block CVE-2024-1562 exploitation attempt'"
    SecRule ARGS:action "@rx execute_post_data" \
        "chain"
        SecRule &REQUEST_COOKIES:/wordpress_logged_in_/ "@eq 0"