Unauthorized Data Access in WooCommerce PDF Invoices Plugin

CVE-2023-7068

Summary

The WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels plugin for WordPress has a security flaw that allows authenticated users, starting from subscriber-level access, to bypass authorization checks. This vulnerability arises from a missing capability check on the print_packinglist action. As a consequence, these users can export sensitive order information, potentially leading to unauthorized data exposure. It is critical for users of this plugin to update to the latest version to mitigate this risk.

References