CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
Missing Authorization vulnerability in Tyche Softwares Print Invoice & Delivery Notes for WooCommerce, Tyche Softwares Arconix Shortcodes, Tyche Softwares Arconix FAQ.This issue affects Print Invoice & Delivery Notes for WooCommerce: from n/a through 4.8.1; Arconix Shortcodes: from n/a through 2.1.10; Arconix FAQ: from n/a through 1.9.3.
Explanation of Vulnerability in Simple Terms
The Print Invoice & Delivery Notes for WooCommerce plugin through version 4.8.1 does not properly check user permissions before allowing modifications to invoices and delivery notes. A logged-in user with low privileges can alter invoice data or delivery note content that should be restricted to administrators or shop managers. This affects data integrity but does not expose sensitive information or disrupt site availability.
What an attacker can do
Modify invoice and delivery note data without proper authorization.
Potential impact on your site
Invoices and delivery notes may be altered by unauthorized users, affecting order records and customer trust.
Conditions required to exploit
Attacker must have a low-privilege WooCommerce user account (e.g., customer or subscriber).
Key dates
External resources
Related vulnerabilities
