WooCommerce PDF Invoices < 4.3.0 - Shop Manager+ Arbitrary Options Update

2024-01-0500:00:00

wpscan.com

woocommerce

pdf invoices

update

shop manager

arbitrary options

7.2 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.0%

JSON

Description The plugin does not have proper authorisation in its JSON import feature, which could allow Shop Manager and above roles to update arbitrary blog options

CPENameOperatorVersion
eq4.3.0

CPE	Name	Operator	Version
		eq	4.3.0

References

patchstack.com/database/vulnerability/print-invoices-packing-slip-labels-for-woocommerce/wordpress-woocommerce-pdf-invoices-packing-slips-delivery-notes-and-shipping-labels-plugin-4-2-1-privilege-escalation-vulnerability