Print Invoice & Delivery Notes for WooCommerce < 4.7.2 - Reflected XSS
CVE-2023-0479
Key Information:
- Vendor
Wordpress
- Vendor
- CVE Published:
- 16 January 2024
Badges
What is CVE-2023-0479?
The Print Invoice & Delivery Notes plugin for WooCommerce has a reflected cross-site scripting (XSS) vulnerability. This security issue arises from improper handling of GET values within admin notes on the WooCommerce orders page. Specifically, the vulnerability is due to a flaw in the processing of the urldecode() function after cleanup with esc_url_raw(). This allows attackers with the edit_others_shop_orders capability to inject malicious scripts, potentially leading to unauthorized data exposure or session hijacking. To mitigate this risk, it is crucial for users to upgrade to version 4.7.2 or higher of the plugin to ensure their sites remain secure.
Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.
Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.
Affected Version(s)
Print Invoice & Delivery Notes for WooCommerce 0 < 4.7.2
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.
References
CVSS V3.1
Timeline
- 🟡
Public PoC available
- 👾
Exploit known to exist
Vulnerability published
Vulnerability Reserved