CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
Deserialization of Untrusted Data vulnerability in add-ons.org PDF Invoice Builder for WooCommerce pdf-for-woocommerce allows Object Injection.This issue affects PDF Invoice Builder for WooCommerce: from n/a through <= 6.5.0.
Explanation of Vulnerability in Simple Terms
PDF Invoice Builder for WooCommerce versions up to 6.5.0 contain a deserialization vulnerability that allows authenticated attackers to execute arbitrary code on the site. The plugin unsafely deserializes untrusted data, enabling an attacker with low-level access to run malicious PHP code with full site privileges. This affects confidentiality, integrity, and availability of the entire WooCommerce installation.
What an attacker can do
Run arbitrary PHP code on the site with full administrative privileges.
Potential impact on your site
A compromised user account can lead to complete site takeover, data theft, malware injection, and loss of customer information.
Conditions required to exploit
Attacker must have a low-level user account (e.g., customer or subscriber role) on the WooCommerce site.
Key dates
External resources
Related vulnerabilities
