CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L
What the vulnerability does
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in add-ons.org PDF Invoice Builder for WooCommerce pdf-for-woocommerce allows SQL Injection.This issue affects PDF Invoice Builder for WooCommerce: from n/a through <= 5.3.8.
Explanation of Vulnerability in Simple Terms
PDF Invoice Builder for WooCommerce versions up to 5.3.8 contain a SQL injection vulnerability in database queries. An attacker with high-level site privileges can craft malicious input to extract sensitive data from the database or disrupt site availability. The vulnerability requires administrative access to exploit and does not affect data integrity.
What an attacker can do
Read sensitive data from the site database or cause temporary service disruption.
Potential impact on your site
A compromised admin account could expose customer data, order details, or payment information stored in your database.
Conditions required to exploit
Attacker must have high-level site privileges (e.g., administrator or shop manager role).
Key dates
External resources
Related vulnerabilities
