Server-Side Request Forgery Vulnerability in WooCommerce Invoices Plugin by WordPress

CVE-2024-3047

What is CVE-2024-3047?

The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress has a vulnerability that allows for Server-Side Request Forgery (SSRF) due to improper validation in the transform() function. This flaw enables unauthenticated attackers to send web requests to any arbitrary location, which could be exploited to access or modify sensitive information from internal services within the web application. Users of the plugin are advised to update to the latest version to mitigate risks associated with this vulnerability.

References