CVE-2024-30470: YITH WooCommerce Account Funds Bypass

CVE-2024-30470 Overview

CVE-2024-30470 is a missing authorization vulnerability [CWE-862] in the YITH WooCommerce Account Funds Premium plugin for WordPress. The flaw affects all versions up to and including 1.33.0. Authenticated attackers with low privileges can exploit broken access control to add arbitrary funds to user accounts. The issue stems from insufficient authorization checks on plugin functionality that manages account balances.

Store operators running the vulnerable plugin face direct financial impact. An attacker can inflate their own balance and use the funds to purchase goods or request refunds, resulting in monetary loss to the merchant.

Critical Impact
Authenticated users can bypass authorization controls to arbitrarily add funds to WooCommerce accounts, enabling financial fraud against store operators.

Affected Products

YITH WooCommerce Account Funds Premium plugin for WordPress
All versions from n/a through 1.33.0
WordPress sites running WooCommerce with the vulnerable plugin installed

Discovery Timeline

2024-06-09 - CVE-2024-30470 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-30470

Vulnerability Analysis

The vulnerability is a broken access control flaw in the YITH WooCommerce Account Funds Premium plugin. The plugin manages a stored balance associated with WooCommerce customer accounts. Handlers responsible for modifying account funds fail to enforce proper authorization checks before executing balance-modifying actions.

An authenticated attacker with a standard customer account can invoke the affected functionality to add arbitrary amounts to an account balance. The credited funds can then be applied to orders or withdrawn depending on merchant configuration. The attack requires only network access and low privileges, with no user interaction from a victim.

Root Cause

The root cause is a missing authorization check [CWE-862] in the plugin code paths that adjust account fund balances. The plugin performs authentication but does not verify that the requesting user is permitted to perform the fund-adjustment action on the target account. Capability checks (current_user_can()) and nonce verification are either absent or improperly enforced on the affected endpoints.

Attack Vector

Exploitation is performed over the network against the WordPress site hosting the vulnerable plugin. An attacker registers or authenticates as a standard WooCommerce customer, then issues a crafted request to the plugin endpoint responsible for modifying funds. Because the endpoint does not validate the caller's authorization, the request is processed and the balance is updated. Full technical details are available in the Patchstack Vulnerability Database Entry.

No public proof-of-concept exploit code has been observed. See the referenced advisory for further technical details.

Detection Methods for CVE-2024-30470

Indicators of Compromise

Unexpected increases in customer account fund balances not tied to legitimate purchases, deposits, or admin adjustments.
Orders placed using account funds by users who have no record of depositing funds.
Anomalous POST requests from authenticated customer sessions targeting the YITH Account Funds plugin endpoints.
Discrepancies between WooCommerce order/payment logs and the plugin's fund transaction records.

Detection Strategies

Review the wp_yith_wcaf (or equivalent) database tables for fund entries lacking a corresponding payment gateway transaction.
Correlate WordPress access logs with plugin AJAX and REST endpoints to identify unauthorized invocations by low-privilege users.
Audit user accounts for balance changes that occur outside the standard checkout or admin workflows.

Monitoring Recommendations

Enable WooCommerce and WordPress audit logging to capture all fund balance modifications with timestamps and user IDs.
Alert on repeated requests to plugin endpoints from single accounts within short time windows.
Track EPSS scoring over time; the current EPSS reflects a low probability of near-term exploitation but should be re-evaluated as new activity emerges.

How to Mitigate CVE-2024-30470

Immediate Actions Required

Update YITH WooCommerce Account Funds Premium to a version later than 1.33.0 that addresses the missing authorization flaw.
Audit customer account balances and refund histories for suspicious activity since the plugin was installed.
Restrict the use of stored account funds pending confirmation that all balances are legitimate.

Patch Information

YITH has released updated versions addressing this vulnerability. Refer to the Patchstack Vulnerability Database Entry for the fixed version and vendor guidance. Apply the update through the WordPress admin dashboard or by installing the patched plugin package directly.

Workarounds

Temporarily disable the YITH WooCommerce Account Funds Premium plugin until the patched version is applied.
Deploy a Web Application Firewall (WAF) rule to block or challenge requests to the plugin's fund-modification endpoints from non-admin users.
Limit new customer registration and monitor existing customer sessions closely while the plugin remains unpatched.

bash

# Verify installed plugin version via WP-CLI
wp plugin get yith-woocommerce-account-funds-premium --field=version

# Deactivate the vulnerable plugin as a temporary mitigation
wp plugin deactivate yith-woocommerce-account-funds-premium

# Update to the patched release once available
wp plugin update yith-woocommerce-account-funds-premium