CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
Missing Authorization vulnerability in WP Overnight WooCommerce PDF Invoices & Packing Slips woocommerce-pdf-invoices-packing-slips allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce PDF Invoices & Packing Slips: from n/a through <= 4.9.1.
Explanation of Vulnerability in Simple Terms
The WooCommerce PDF Invoices & Packing Slips plugin for WordPress does not properly check user permissions before allowing modifications to invoice and packing slip data. A logged-in user with low privileges can alter invoice records or packing slip content that they should not have access to. This affects all versions up to 4.9.1.
What an attacker can do
A logged-in user can modify invoice or packing slip records belonging to other orders or users.
Potential impact on your site
Order records and customer-facing documents may be altered without authorization, risking data integrity and customer trust.
Conditions required to exploit
Attacker must have a low-privilege WordPress user account (e.g., subscriber or customer role).
Key dates
External resources
Related vulnerabilities
