CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
What the vulnerability does
Missing Authorization vulnerability in tychesoftwares Print Invoice & Delivery Notes for WooCommerce woocommerce-delivery-notes allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Print Invoice & Delivery Notes for WooCommerce: from n/a through <= 5.9.0.
Explanation of Vulnerability in Simple Terms
The Print Invoice & Delivery Notes for WooCommerce plugin through version 5.9.0 does not properly check user permissions before allowing access to sensitive invoice and delivery note data. An unauthenticated attacker can read invoices and delivery notes belonging to other customers or orders by making direct requests to the plugin. This exposes customer names, addresses, order details, and other information stored in those documents.
What an attacker can do
Read invoices and delivery notes for any order without authentication or permission.
Potential impact on your site
Customer order details, addresses, and invoice information are exposed to anyone who discovers the vulnerable endpoint.
Conditions required to exploit
Network access to the WooCommerce site; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
