CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
The Print Invoice & Delivery Notes for WooCommerce plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 5.8.0 via the 'WooCommerce_Delivery_Notes::update' function. This is due to missing capability check in the 'WooCommerce_Delivery_Notes::update' function, PHP enabled in Dompdf, and missing escape in the 'template.php' file. This makes it possible for unauthenticated attackers to execute code on the server.
Explanation of Vulnerability in Simple Terms
The Print Invoice & Delivery Notes for WooCommerce plugin contains a code injection vulnerability that allows unauthenticated attackers to run arbitrary PHP code on affected sites. No user interaction or special privileges are required. All versions up to 5.8.0 are affected. Site administrators should update immediately to a patched version.
What an attacker can do
Run arbitrary PHP code on the site without authentication.
Potential impact on your site
Complete compromise of the WooCommerce site, including data theft, malware injection, and site takeover.
Conditions required to exploit
Network access only; no authentication or user interaction required.
Key dates
External resources
