Blacklist Manager
Monthly
Blocked accounts can keep authenticating on the authentication paths that the Blacklist Manager for WooCommerce WordPress plugin (versions 1.3.0 through 2.3.1) fails to hook, so a user whom the site owner has explicitly blocked retains the privileges of their original role - typically a customer-level WordPress/WooCommerce account - with the block neither enforced nor recorded. Exploitation requires the attacker to already hold valid credentials for a blocked account (CVSS 3.1 score 5.4, AV:N/AC:L/PR:L/UI:N, authenticated), and publicly available exploit code exists, though no confirmed active exploitation (CISA KEV) is indicated at time of analysis. Because access is capped at the account's existing role, there is no privilege escalation - impact is limited to confidentiality and integrity of data that account could already reach, plus the failure of the blocking control itself.
Blocked accounts can keep authenticating on the authentication paths that the Blacklist Manager for WooCommerce WordPress plugin (versions 1.3.0 through 2.3.1) fails to hook, so a user whom the site owner has explicitly blocked retains the privileges of their original role - typically a customer-level WordPress/WooCommerce account - with the block neither enforced nor recorded. Exploitation requires the attacker to already hold valid credentials for a blocked account (CVSS 3.1 score 5.4, AV:N/AC:L/PR:L/UI:N, authenticated), and publicly available exploit code exists, though no confirmed active exploitation (CISA KEV) is indicated at time of analysis. Because access is capped at the account's existing role, there is no privilege escalation - impact is limited to confidentiality and integrity of data that account could already reach, plus the failure of the blocking control itself.