CVE-2024-9927: WooCommerce Order Proposal Escalation Flaw

CVE-2024-9927 Overview

The WooCommerce Order Proposal plugin for WordPress contains a privilege escalation vulnerability affecting all versions up to and including 2.0.5. The flaw stems from improper implementation of the allow_payment_without_login function. Authenticated attackers with Shop Manager-level access or higher can authenticate to WordPress as any arbitrary user, including administrators. The vulnerability is tracked as [CWE-287] Improper Authentication and carries a CVSS score of 7.2. Successful exploitation grants full administrative control over the affected WordPress site, including the ability to install malicious plugins, modify content, and access sensitive customer data stored by WooCommerce.

Critical Impact
Shop Manager accounts can escalate to full administrator privileges by logging in as arbitrary users through the flawed payment-without-login flow.

Affected Products

Wpovernight WooCommerce Order Proposal plugin for WordPress
All versions up to and including 2.0.5
WordPress sites running WooCommerce with the Order Proposal extension installed

Discovery Timeline

2024-10-23 - CVE-2024-9927 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-9927

Vulnerability Analysis

The vulnerability resides in the allow_payment_without_login function of the WooCommerce Order Proposal plugin. This function is intended to permit customers to complete payments on order proposals without requiring them to log in. The implementation fails to properly validate the identity of the requesting user against the intended proposal recipient. An attacker who already holds Shop Manager privileges can abuse this authentication logic to establish a session as any other WordPress user account. Because WordPress administrator accounts are valid targets, the flaw enables vertical privilege escalation from Shop Manager to administrator. WooCommerce Shop Manager is a role commonly delegated to staff members managing orders, making the pool of potential attackers broader than administrator-only vulnerabilities.

Root Cause

The root cause is improper authentication [CWE-287] within the payment-without-login workflow. The allow_payment_without_login function accepts an identifier that determines which user account the request should operate under, but does not sufficiently verify that the requester is authorized to act as that user. As a result, an authenticated Shop Manager can supply a target identifier corresponding to an administrator and receive a valid authenticated session for that account.

Attack Vector

Exploitation requires network access to the WordPress site and prior authentication with at least Shop Manager privileges. No user interaction from the victim is required. The attacker interacts with the plugin endpoint responsible for the order proposal payment flow and manipulates parameters to authenticate as a chosen administrator account. Once logged in as an administrator, the attacker can perform any action available to that role, including uploading plugins or themes that yield remote code execution on the underlying server.

No verified public exploit code is available. See the Wordfence Vulnerability Report for technical details.

Detection Methods for CVE-2024-9927

Indicators of Compromise

Unexpected administrator logins originating from IP addresses previously associated only with Shop Manager accounts.
New administrator accounts, plugin installations, or theme uploads that do not match change-management records.
WordPress wp_users or wp_usermeta modifications following requests to WooCommerce Order Proposal endpoints.
Access-log entries invoking the plugin's payment-without-login handler followed by authenticated sessions for higher-privileged users.

Detection Strategies

Correlate Shop Manager session activity with subsequent administrator-level actions occurring in the same browser session or IP range.
Monitor WordPress audit logs for role changes, privilege modifications, and administrative logins outside normal business hours.
Inspect web server logs for POST requests to WooCommerce Order Proposal endpoints that reference administrator usernames or user IDs.

Monitoring Recommendations

Enable a WordPress activity logging plugin to record authentication events, role changes, and plugin installations.
Forward WordPress and web server logs to a centralized SIEM for cross-account correlation and long-term retention.
Alert on any successful administrator authentication that follows recent activity from a Shop Manager account within a short time window.

How to Mitigate CVE-2024-9927

Immediate Actions Required

Update the WooCommerce Order Proposal plugin to a version later than 2.0.5 as soon as the vendor publishes a fixed release.
Audit all WordPress accounts with Shop Manager or higher privileges and remove unused or unnecessary accounts.
Reset passwords and invalidate active sessions for all administrator and Shop Manager accounts.
Review recent administrator activity, installed plugins, and theme files for signs of unauthorized modification.

Patch Information

At the time of the NVD advisory, all versions up to and including 2.0.5 are affected. Consult the WooCommerce Order Proposal download page for the latest release and confirm that the version installed on your site is above 2.0.5 before returning it to production.

Workarounds

Deactivate and remove the WooCommerce Order Proposal plugin until a patched version is installed.
Restrict the Shop Manager role to a minimal set of trusted personnel and enforce multi-factor authentication for all privileged WordPress accounts.
Deploy a WordPress web application firewall to block requests targeting the plugin's payment-without-login endpoint from untrusted sources.

bash

# Disable the vulnerable plugin via WP-CLI until a patched version is available
wp plugin deactivate woocommerce-order-proposal
wp plugin delete woocommerce-order-proposal

# List all users with Shop Manager or Administrator roles for review
wp user list --role=shop_manager --fields=ID,user_login,user_email,user_registered
wp user list --role=administrator --fields=ID,user_login,user_email,user_registered