CVE-2023-4161: WooCommerce PDF Invoice Builder <= 1.2.90 - Cross-Site Request Forgery to Custom Field Creation
The WooCommerce PDF Invoice Builder for WordPress is vulnerable to Cross-Site Request Forgery due to a missing nonce check on the SaveCustomField function in versions up to, and including, 1.2.90. This makes it possible for unauthenticated attackers to create invoice fields provided they can trick an admin into performing an action such as clicking on a link.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the vulnerability ID for the WooCommerce PDF Invoice Builder for WordPress vulnerability?
The vulnerability ID for the WooCommerce PDF Invoice Builder for WordPress vulnerability is CVE-2023-4161.
What is the severity of CVE-2023-4161?
The severity of CVE-2023-4161 is medium with a CVSS score of 4.3.
What is the affected software and version of CVE-2023-4161?
The affected software is Rednao Woocommerce Pdf Invoice Builder for WordPress. The vulnerable versions are up to and including 1.2.90.
What is the CWE ID for CVE-2023-4161?
The CWE ID for CVE-2023-4161 is 352.
How can I fix the WooCommerce PDF Invoice Builder for WordPress vulnerability (CVE-2023-4161)?
To fix the CVE-2023-4161 vulnerability, update the Rednao Woocommerce Pdf Invoice Builder plugin to version 1.2.91 or later.