CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L
What the vulnerability does
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Overnight PDF Invoices & Packing Slips for WooCommerce.This issue affects PDF Invoices & Packing Slips for WooCommerce: from n/a through 3.7.5.
Explanation of Vulnerability in Simple Terms
A SQL injection vulnerability in PDF Invoices & Packing Slips for WooCommerce allows high-privileged users to read sensitive database information. The vulnerability requires administrator access and does not affect data integrity. An attacker with admin credentials can extract confidential data from the site's database, and the impact extends beyond the plugin itself.
What an attacker can do
Read sensitive data from the site's database using SQL injection.
Potential impact on your site
An admin account compromise could expose your entire database contents, including customer data and payment information.
Conditions required to exploit
Attacker must have administrator-level access to the WordPress site.
Key dates
External resources
Related vulnerabilities
