CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
What the vulnerability does
The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 3.8.0 via the transform() function. This can allow unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Explanation of Vulnerability in Simple Terms
The PDF Invoices & Packing Slips for WooCommerce plugin through version 3.8.0 contains a server-side request forgery vulnerability. An attacker can make the site send HTTP requests to internal or external systems on the attacker's behalf. No authentication or user interaction is required. This could expose internal services or be used to attack other systems.
What an attacker can do
Make the site send HTTP requests to internal or external systems without authorization.
Potential impact on your site
Attackers can probe your internal network, access internal services, or use your site to attack other systems.
Conditions required to exploit
Network access to the site; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
