WooCommerce PDF Invoices < 4.3.1 - Subscriber+ Arbitrary Order Export

2024-01-0300:00:00

wpscan.com

woocommerce pdf invoices

vulnerability

unauthorized access

data

capability check

print_packinglist

authenticated attackers

subscriber-level

export orders

sensitive information

6.4 Medium

AI Score

Confidence

High

0.0005 Low

EPSS

Percentile

18.3%

JSON

Description The plugin is vulnerable to unauthorized access of data due to a missing capability check on theprint_packinglist action. This makes it possible for authenticated attackers, with subscriber-level access and above, to export orders which can contain sensitive information.