CVE-2023-3764
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
The WooCommerce PDF Invoice Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to and including 1.2.90. This is due to missing or incorrect nonce validation on the Save function, allowing unauthenticated attackers to make changes to invoices via a forged request.
Risk Assessment
Attackers can exploit this vulnerability to manipulate invoices, potentially leading to financial fraud or data integrity issues. The risk increases if administrators are tricked into performing specific actions.
Recommendation
It is recommended to update the plugin to the latest version to mitigate this vulnerability. Additionally, implementing extra security measures, such as monitoring administrator actions, is advisable.
Original NVD description (English source)
The WooCommerce PDF Invoice Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.90. This is due to missing or incorrect nonce validation on the Save function. This makes it possible for unauthenticated attackers to make changes to invoices via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.