Vulnerability in PDF Invoices and Packing Slips Plugin Allows PHP Object Injection and File Delete

CVE-2024-1773

Summary

The PDF Invoices and Packing Slips for WooCommerce plugin, utilized within WordPress sites, is vulnerable to a PHP Object Injection due to improper handling of the order_id parameter. This vulnerability enables authenticated attackers, including those with subscriber-level access, to inject malicious PHP objects through deserialization of untrusted data. Although the vulnerable plugin does not create a known PHP Object Injection (POP) chain itself, the presence of additional plugins or themes with their own vulnerabilities could facilitate an attacker in executing arbitrary code, deleting files, or exposing sensitive information.

References