CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
What the vulnerability does
The Print Invoice & Delivery Notes for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.4.1 via the 'wcdn/invoice' directory. This makes it possible for unauthenticated attackers to extract sensitive data stored insecurely in the /wp-content/uploads/wcdn/invoice directory which can contain invoice files if an email attachment setting is enabled.
Explanation of Vulnerability in Simple Terms
The Print Invoice & Delivery Notes for WooCommerce plugin exposes sensitive information through an information disclosure vulnerability. An attacker can retrieve confidential data without authentication by exploiting a flaw in how the plugin handles access controls. The vulnerability affects all versions up to 5.4.1. Site owners should update to a patched version immediately.
What an attacker can do
Read sensitive data from the plugin without logging in.
Potential impact on your site
Customer invoices, delivery notes, and order details may be exposed to unauthorized visitors.
Conditions required to exploit
Network access to the site; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
