CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
What the vulnerability does
The WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on theprint_packinglist action in all versions up to, and including, 4.3.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to export orders which can contain sensitive information.
Explanation of Vulnerability in Simple Terms
The WebToffee WooCommerce PDF Invoices plugin through version 4.3.0 fails to properly check user permissions before allowing access to sensitive invoice and shipping data. A logged-in user with low privileges can view PDF documents and related information they should not have access to. This affects the confidentiality of order and customer data stored within the plugin.
What an attacker can do
View PDF invoices, packing slips, and shipping labels belonging to other customers or orders.
Potential impact on your site
Customer order details, invoices, and shipping information may be exposed to unauthorized users with site access.
Conditions required to exploit
Attacker must have a low-privilege account on the WordPress site (e.g., subscriber or customer role).
Key dates
External resources
Related vulnerabilities
