CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
What the vulnerability does
Missing Authorization vulnerability in EDGARROJAS WooCommerce PDF Invoice Builder woo-pdf-invoice-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce PDF Invoice Builder: from n/a through <= 1.2.150.
Explanation of Vulnerability in Simple Terms
WooCommerce PDF Invoice Builder versions up to 1.2.150 lack proper authorization checks, allowing authenticated users to access invoice data they should not be able to view. An attacker with a low-privilege account can read sensitive invoice information belonging to other users or orders. Update to a version newer than 1.2.150 to resolve this issue.
What an attacker can do
Read invoice data and sensitive order information belonging to other users or orders.
Potential impact on your site
Customer invoice data and order details may be exposed to unauthorized users with site access.
Conditions required to exploit
Attacker must have a valid low-privilege account on the WordPress site.
Key dates
External resources
