Vulnerability in PDF Invoices and Packing Slips Plugin Allows PHP Object Injection and File Delete

CVE-2024-1773

What is CVE-2024-1773?

The PDF Invoices and Packing Slips for WooCommerce plugin, utilized within WordPress sites, is vulnerable to a PHP Object Injection due to improper handling of the order_id parameter. This vulnerability enables authenticated attackers, including those with subscriber-level access, to inject malicious PHP objects through deserialization of untrusted data. Although the vulnerable plugin does not create a known PHP Object Injection (POP) chain itself, the presence of additional plugins or themes with their own vulnerabilities could facilitate an attacker in executing arbitrary code, deleting files, or exposing sensitive information.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References