Server-Side Request Forgery Vulnerability in WooCommerce Invoices Plugin by WordPress
CVE-2024-3047

7.2HIGH

Key Information:

Vendor
Wordpress
Status
PDF Invoices & Packing Slips For WooCommerce
Vendor
CVE Published:
2 May 2024

Summary

The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress has a vulnerability that allows for Server-Side Request Forgery (SSRF) due to improper validation in the transform() function. This flaw enables unauthenticated attackers to send web requests to any arbitrary location, which could be exploited to access or modify sensitive information from internal services within the web application. Users of the plugin are advised to update to the latest version to mitigate risks associated with this vulnerability.

Affected Version(s)

PDF Invoices & Packing Slips for WooCommerce * <= 3.8.0

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/changeset/3076105/

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Tim Coen
.