CVE-2023-4245 - WooCommerce PDF Invoice Builder <= 1.2.89 - Missing Authorization to Sensitive Information Exposure

Back Back to CVE browser

MEDIUM

WooCommerce PDF Invoice Builder <= 1.2.89 - Missing Authorization to Sensitive Information Exposure

Published Aug 31, 2023

4.3

MEDIUM

CVSS 3.1

EPSS 0.54%

Description

The WooCommerce PDF Invoice Builder for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the GetInvoiceDetail function in versions up to, and including, 1.2.89. This makes it possible for subscribers to view arbitrary invoices provided they can guess the order id and invoice id.

Affected products

Vendor Edgarrojas Product PDF Builder for WooCommerce. Create invoices,packing slips and more Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <=1.2.91

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Edgarrojas

PDF Builder for WooCommerce. Create invoices,packing slips and more

unaffected

Version	Status	Constraints
0	affected	<=1.2.91

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-862

Missing Authorization

References (3)

Link	Providers	Tags
https://plugins.trac.wordpress.org/browser/woo-pdf-invoice-builder/trunk/woocommerce-pdf-invoice-ajax.php#L425		Patch
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2955112%40woo-pdf-invoice-builder%2Ftrunk&old=2953379%40woo-pdf-invoice-builder%2Ftrunk&sfp_email=&sfph_mail=#file1		Patch
https://www.wordfence.com/threat-intel/vulnerabilities/id/200fbfc1-df21-43b0-8eb1-b2ba0cc0c0df?source=cve		Third Party Advisory