What’s Vulnerable › Vulnerabilities

CVE-2024-1686: Thank You Page Customizer for WooCommerce – Increase Your Sales <= 1.1.2 - Missing Authorization to Authenticated (Subscriber+) Data Export

• Severity: medium (CVSS 4.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-02-27 · updated 2026-06-17
• Weakness: CWE-862

Description

The Thank You Page Customizer for WooCommerce – Increase Your Sales plugin for WordPress is vulnerable to missing authorization e in all versions up to, and including, 1.1.2 via the apply_layout function due to a missing capability check. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve arbitrary order data which may contain PII.

Affected products

• VillaTheme Thank You Page Customizer for WooCommerce – Increase Your Sales: before 1.1.3 — fixed in 1.1.3

How to fix

Upgrade to a fixed version: VillaTheme Thank You Page Customizer for WooCommerce – Increase Your Sales 1.1.3. Check the vendor advisory for mitigations.

References

• https://plugins.trac.wordpress.org/changeset/3041096/woo-thank-you-page-customizer/trunk/frontend/frontend.php
• https://www.wordfence.com/threat-intel/vulnerabilities/id/2e7ebc0c-6936-4632-a602-7131c7d8bd6a?source=cve
• https://plugins.trac.wordpress.org/changeset/3041096/woo-thank-you-page-customizer/trunk/frontend/frontend.php
• https://www.wordfence.com/threat-intel/vulnerabilities/id/2e7ebc0c-6936-4632-a602-7131c7d8bd6a?source=cve

Get alerted when CVE-2024-1686 or the next vulnerability affects your stack