CVE-2024-1203 is a high severity SQL injection in the Conversios Google Analytics 4, Meta Pixel and Google Tag Manager plugin for WooCommerce on WordPress. It affects versions up to and including 7.0.7 and scores 8.8. Any logged in user, even a subscriber, can reach it. Update to a release newer than 7.0.7.
What's affected
The record covers all versions of the Conversios plugin up to and including 7.0.7. The weak spot is the valueData parameter, which the plugin passes into a database query without enough escaping or query preparation.
The attacker needs an account, but only subscriber level or above. On a WooCommerce shop that lets customers register, that bar is low. NVD scores it 8.8 with network access, low complexity and low privileges.
The record does not name a fixed version. The references include a WordPress plugin Trac changeset and a Wordfence entry, but I could not retrieve the Wordfence page, so the advisory should be checked for the exact patched release. Anything newer than 7.0.7 from the plugin directory is the safe direction to move.
Weakness class: CWE-89. The NVD record carries the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H and a score of 8.8.
How to check if you're exposed
The plugin directory slug that appears in the record's source links is enhanced-e-commerce-for-woocommerce-store. With WP-CLI on the server you can list the installed version.
wp plugin list --fields=name,version,status | grep -i enhanced-e-commerce
If you do not have shell access, open Plugins in the WordPress admin and read the version under the plugin name. A version of 7.0.7 or lower is in the affected range. Also check Users for subscriber accounts you do not recognise, since the flaw needs a logged in session.
Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan for the libraries in your own projects, and reachability analysis helps you tell which findings your code actually calls.
What to do now
- Update the Conversios plugin to the latest release from the WordPress plugin directory, then confirm the version is above 7.0.7.
- Read the Wordfence entry linked in the record for the exact patched version and write it into your change ticket.
- Review user registrations on shops with open sign up and remove accounts you cannot explain.
- Check database and web server logs for unusual requests carrying the valueData parameter around and after the publish date of 13 March 2024.
- If the plugin is not needed for reporting, deactivate and delete it.
Why it matters
SQL injection happens when user input is stitched into a query string instead of being passed as a bound parameter. The record says the plugin lacked both escaping and query preparation. The class is CWE-89, and it has a long history in WordPress plugins.
Here the impact rating is high across confidentiality, integrity and availability. The record's description focuses on extracting sensitive data from the database. In a WooCommerce store that can mean customer and order data. The record does not list this CVE as known exploited, and the CISA KEV flag is false.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Do I need to be logged in to exploit this?
Yes. The record says authenticated attackers with subscriber level access and above. A shop with open registration makes that easy to meet, so do not treat it as an admin only issue.
Is CVE-2024-1203 known to be exploited?
The record's KEV flag is false and I found no advisory stating exploitation. That is not proof it is safe, so patch anyway.
Sources
Last reviewed: 19 October 2026.
