CVE-2023-4245
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk34th percentile - higher than 34% of all known CVEs
Summary
The WooCommerce PDF Invoice Builder for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the GetInvoiceDetail function in versions up to and including 1.2.89. This allows subscribers to view arbitrary invoices if they can guess the order id and invoice id.
Risk Assessment
The organization may be exposed to the disclosure of sensitive financial information, potentially leading to customer privacy breaches and financial losses.
Recommendation
It is recommended to update the WooCommerce PDF Invoice Builder to the latest version to mitigate this vulnerability and implement additional security measures to restrict access to invoice data.
Original NVD description (English source)
The WooCommerce PDF Invoice Builder for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the GetInvoiceDetail function in versions up to, and including, 1.2.89. This makes it possible for subscribers to view arbitrary invoices provided they can guess the order id and invoice id.