CVE-2024-9189 - CVE House
Back to Database
Status published Medium CVE-2024-9189

EU/UK VAT Manager for WooCommerce <= 2.12.12 - Missing Authorization

Vulnerability Description

The EU/UK VAT Manager for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the alg_wc_eu_vat_exempt_vat_from_admin() function in all versions up to, and including, 2.12.12. This makes it possible for unauthenticated attackers to update the VAT status for any order.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-9189

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Francesco Carlucci

References

More from wpcodefactory

View All →
CVE-2025-14399
Download Plugins and Themes from Dashboard <= 1.9.6 - Cross-Site Request Forgery to Bulk Plugin/Theme Archival
Medium 4.3
CVE-2025-10167
Stock History & Reports Manager for WooCommerce <= 2.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium 6.4
CVE-2024-9384
Quantity Dynamic Pricing & Bulk Discounts for WooCommerce <= 3.8.0 - Reflected Cross-Site Scripting
Medium 6.1
CVE-2024-9377
Products, Order & Customers Export for WooCommerce <= 2.0.15 - Reflected Cross-Site Scripting
Medium 6.1
CVE-2024-9232
Download Plugins and Themes in ZIP from Dashboard <= 1.9.1 - Reflected Cross-Site Scripting
Medium 6.1

Affected Vendor

wpcodefactory

View all reports →

Affected Software

EU/UK VAT Validation Manager for WooCommerce
Vulnerable Versions:
0

Timeline

Official Publish: September 28th, 2024
Last Modified: April 8th, 2026
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weaknesses (CWE)

CWE-862

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1068 Exploitation for Privilege Escalation
Privilege Escalation
T1078 Valid Accounts
Persistence
T1531 Account Access Removal
Impact