CVE-2024-30230 HIGH

CVE-2024-30230: WordPress PDF Invoices and Packing Slips For WooCommerce plugin <= 1.3.7 - PHP Object Injection vulnerability

Vendor Acowebs
Product PDF Invoices and Packing Slips For WooCommerce
Weakness CWE-502 · Unsafe deserialization
Published March 28, 2024
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

8.2/10
Attack vector Network
Attack complexity High
Privileges required Low
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N

What the vulnerability does

01Description

Deserialization of Untrusted Data vulnerability in Acowebs PDF Invoices and Packing Slips For WooCommerce.This issue affects PDF Invoices and Packing Slips For WooCommerce: from n/a through 1.3.7.

Explanation of Vulnerability in Simple Terms

02Summary

The PDF Invoices and Packing Slips For WooCommerce plugin through version 1.3.7 deserializes untrusted data without validation. An authenticated attacker with low privileges can exploit this to read sensitive data or modify site content. The vulnerability affects the entire WooCommerce installation due to scope change.

What an attacker can do

03Attacker Capabilities

Read sensitive data or modify site content by sending a crafted request.

Potential impact on your site

04Site Impact

Attackers with customer or subscriber accounts can access confidential data or alter invoices and orders.

Conditions required to exploit

05Prerequisites

Attacker must have a low-privilege WooCommerce account; no user interaction required.

Key dates

06Disclosure timeline

March 28, 2024 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-57677 WordPress Novalnet Payment Gateway for WooCommerce plugin <= 12.10.3 - PHP Object Injection vulnerability CVE-2026-49105 WordPress WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms plugin <= 1.1.4 - PHP Object Injection vulnerability CVE-2026-49104 WordPress Integration for Keap/infusionsoft and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms plugin <= 1.2.1 - PHP Object Injection vulnerability CVE-2026-39478 WordPress Anti-Malware Security and Brute-Force Firewall plugin <= 4.23.87 - PHP Object Injection vulnerability CVE-2026-12240 Export User Data <= 2.2.6 - Authenticated (Subscriber+) PHP Object Injection to Arbitrary File Deletion via display_name Field