CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
What the vulnerability does
The WooCommerce PDF Invoice Builder for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the GetInvoiceDetail function in versions up to, and including, 1.2.89. This makes it possible for subscribers to view arbitrary invoices provided they can guess the order id and invoice id.
Explanation of Vulnerability in Simple Terms
PDF Builder for WooCommerce versions up to 1.2.91 lack proper authorization checks, allowing authenticated users to access sensitive information they should not be able to view. An attacker with a low-privilege account can read data intended for other users or roles. Update to a version newer than 1.2.91 to resolve this issue.
What an attacker can do
Read sensitive data (invoices, packing slips, customer information) belonging to other users or orders.
Potential impact on your site
Customer data and order information may be exposed to unauthorized users with site access.
Conditions required to exploit
Attacker must have a valid WooCommerce user account with at least low-level privileges.
Key dates
External resources
Related vulnerabilities
