SQL Injection Vulnerability in WooCommerce PDF Invoice Builder Plugin for WordPress
CVE-2023-3677
8.8HIGH
Key Information:
- Vendor
- Wordpress
- Vendor
- CVE Published:
- 31 August 2023
Summary
The WooCommerce PDF Invoice Builder plugin for WordPress is susceptible to SQL Injection via the 'pageId' parameter. This vulnerability arises from improper escaping of user-supplied data and inadequate preparation of existing SQL queries. As a result, users with subscriber permissions or higher can exploit this flaw to inject additional SQL queries into existing ones, potentially allowing unauthorized access to sensitive information stored in the database.
Affected Version(s)
WooCommerce PDF Invoice Builder, Create invoices, packing slips and more * <= 1.2.89
References
CVSS V3.1
Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Marco Wotschka