CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
The WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wt_pklist_reset_settings() function in all versions up to, and including, 4.4.2. This makes it possible for unauthenticated attackers to reset all of the plugin's settings.
Explanation of Vulnerability in Simple Terms
The WebToffee WooCommerce PDF Invoices plugin through version 4.4.2 lacks proper authorization checks on certain functions. An attacker without authentication can modify invoice data or other protected resources by sending direct requests to the vulnerable endpoints. This affects the integrity of order records and related documents.
What an attacker can do
Modify invoice data and order information without logging in.
Potential impact on your site
Attackers can alter invoices, packing slips, and shipping labels, potentially causing billing disputes and order fulfillment errors.
Conditions required to exploit
Network access to the site; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
