What the vulnerability does
01Description
The Print Labels with Barcodes. Create price tags, product labels, order labels for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data, modification of data, and loss of data due to an improper capability check on 42 separate AJAX functions in all versions up to, and including, 3.4.6. This makes it possible for authenticated attackers, with subscriber access and above, to fully control the plugin which includes the ability to modify plugin settings and profiles, and create, edit, retrieve, and delete templates and barcodes.
Explanation of Vulnerability in Simple Terms
02Summary
The Print Labels with Barcodes plugin for WooCommerce versions 3.4.6 and earlier fails to properly check user permissions before allowing access to sensitive functions. A logged-in user with low privileges can read, modify, or delete data they should not have access to. Site owners should update to a version newer than 3.4.6 as soon as possible.
What an attacker can do
03Attacker Capabilities
Read, modify, or delete data without proper authorization as a low-privilege logged-in user.
Potential impact on your site
04Site Impact
Unauthorized users can access or alter label, barcode, and pricing data managed by the plugin.
Conditions required to exploit
05Prerequisites
Attacker must have a low-privilege account on the site (e.g., subscriber or contributor role).
Key dates
06Disclosure timeline
May 2, 2024
CVE published
April 8, 2026
Record updated
