SQL Injection Vulnerability in WooCommerce PDF Invoice Builder Plugin for WordPress
CVE-2023-3677
8.8HIGH
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 31 August 2023
What is CVE-2023-3677?
The WooCommerce PDF Invoice Builder plugin for WordPress is susceptible to SQL Injection via the 'pageId' parameter. This vulnerability arises from improper escaping of user-supplied data and inadequate preparation of existing SQL queries. As a result, users with subscriber permissions or higher can exploit this flaw to inject additional SQL queries into existing ones, potentially allowing unauthorized access to sensitive information stored in the database.
Affected Version(s)
WooCommerce PDF Invoice Builder, Create invoices, packing slips and more * <= 1.2.89