Print Invoice & Delivery Notes for WooCommerce < 4.7.2 - Reflected XSS
CVE-2023-0479

6.1MEDIUM

Key Information:

Vendor
Wordpress
Status
Print Invoice & Delivery Notes for WooCommerce
Vendor
CVE Published:
16 January 2024

Badges

👾 Exploit Exists🟡 Public PoC

Summary

The Print Invoice & Delivery Notes plugin for WooCommerce has a reflected cross-site scripting (XSS) vulnerability. This security issue arises from improper handling of GET values within admin notes on the WooCommerce orders page. Specifically, the vulnerability is due to a flaw in the processing of the urldecode() function after cleanup with esc_url_raw(). This allows attackers with the edit_others_shop_orders capability to inject malicious scripts, potentially leading to unauthorized data exposure or session hijacking. To mitigate this risk, it is crucial for users to upgrade to version 4.7.2 or higher of the plugin to ensure their sites remain secure.

Affected Version(s)

Print Invoice & Delivery Notes for WooCommerce 0 < 4.7.2

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2023-0479 - Proof of Concept

References

https://wpscan.com/vulnerability/50963747-ae8e-42b4-bb42-...
exploitvdb-entrytechnical-description

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

dc11
WPScan
.