CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
What the vulnerability does
Improper Control of Generation of Code ('Code Injection') vulnerability in Edgar Rojas WooCommerce PDF Invoice Builder allows Remote Code Inclusion. This issue affects WooCommerce PDF Invoice Builder: from n/a through 2.0.8.
Explanation of Vulnerability in Simple Terms
WooCommerce PDF Invoice Builder versions up to 2.0.8 contain a code injection vulnerability that allows unauthenticated attackers to run arbitrary PHP code on the site without user interaction. The vulnerability exists in how the plugin processes user input, enabling complete compromise of the WordPress installation including data theft, malware injection, and site takeover.
What an attacker can do
Run arbitrary PHP code on your site and take complete control of it.
Potential impact on your site
Complete compromise of your WordPress site, including data theft, malware injection, and loss of control.
Conditions required to exploit
Network access only; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
