CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
What the vulnerability does
Cross-Site Request Forgery (CSRF) vulnerability in wpdesk Flexible PDF Invoices for WooCommerce & WordPress flexible-invoices allows Cross Site Request Forgery.This issue affects Flexible PDF Invoices for WooCommerce & WordPress: from n/a through <= 6.0.13.
Explanation of Vulnerability in Simple Terms
The Flexible PDF Invoices for WooCommerce & WordPress plugin versions 6.0.13 and earlier are vulnerable to cross-site request forgery (CSRF). An attacker can craft a malicious webpage that, when visited by a logged-in site administrator, performs unwanted actions on the site without the admin's knowledge or consent. This can result in data modification or site disruption.
What an attacker can do
Trick a logged-in admin into performing unwanted actions (data changes, settings modifications) by visiting a malicious webpage.
Potential impact on your site
Administrators could unknowingly modify invoices, settings, or other plugin data if tricked into visiting a malicious link while logged in.
Conditions required to exploit
Admin must be logged in and visit attacker-controlled webpage; no special privileges or authentication required from attacker.
Key dates
External resources
