CVE-2024-34370 WordPress EAN for WooCommerce plugin <= 4.8.9 - Arbitrary Option Update to Privilege Escalation vulnerability

Q: What is CVE-2024-34370?

CVE-2024-34370 is a high-severity vulnerability in WPFactory EAN for WooCommerce, published on 17 May 2024. An attacker needs administrator access to exploit it, with no action from the victim.

Q: Is CVE-2024-34370 being exploited?

There is no known exploitation of CVE-2024-34370 in the wild and no public exploit code.

Q: How do I fix CVE-2024-34370?

No fix has been published for CVE-2024-34370 yet. Limit exposure of the affected software until one is available.

High 7.2 Published 17 May 2024 Updated 28 Apr 2026

An attacker can exploit improper privilege management in the EAN for WooCommerce plugin to escalate privileges within the WordPress environment.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2024-34370?

CVE-2024-34370 is a high-severity vulnerability in WPFactory EAN for WooCommerce, published on 17 May 2024. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

Improper Privilege Management vulnerability in WPFactory EAN for WooCommerce allows Privilege Escalation.This issue affects EAN for WooCommerce: from n/a through 4.8.9.

Weakness: CWE-269

Which versions are affected by CVE-2024-34370?

It affects 1 product.

Products include Wpfactory Ean for Woocommerce.

How do I fix CVE-2024-34370?

No fix has been published for CVE-2024-34370 yet. Limit exposure of the affected software until one is available.

Is CVE-2024-34370 being exploited?

There is no known exploitation of CVE-2024-34370 in the wild and no public exploit code.

Public exploit code: 1 proofs of concept on GitHub.

Sources

Also known as GHSA-mcgh-62x5-2v7c.