CVE-2023-4161: CSRF
First published: Thu Aug 31 2023(Updated: )
The WooCommerce PDF Invoice Builder for WordPress is vulnerable to Cross-Site Request Forgery due to a missing nonce check on the SaveCustomField function in versions up to, and including, 1.2.90. This makes it possible for unauthenticated attackers to create invoice fields provided they can trick an admin into performing an action such as clicking on a link.
Credit: security@wordfence.com security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Rednao Woocommerce Pdf Invoice Builder | <=1.2.90 | |
| <=1.2.90 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://plugins.trac.wordpress.org/browser/woo-pdf-invoice-builder/trunk/woocommerce-pdf-invoice-ajax.php?rev=2935371#L654
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2953379%40woo-pdf-invoice-builder%2Ftrunk&old=2951617%40woo-pdf-invoice-builder%2Ftrunk&sfp_email=&sfph_mail=
- https://www.wordfence.com/threat-intel/vulnerabilities/id/3b7aac1c-6962-49cf-850f-ab7b1d220090?source=cve
Frequently Asked Questions
What is the vulnerability ID for the WooCommerce PDF Invoice Builder for WordPress vulnerability?
The vulnerability ID for the WooCommerce PDF Invoice Builder for WordPress vulnerability is CVE-2023-4161.
What is the severity of CVE-2023-4161?
The severity of CVE-2023-4161 is medium with a CVSS score of 4.3.
What is the affected software and version of CVE-2023-4161?
The affected software is Rednao Woocommerce Pdf Invoice Builder for WordPress. The vulnerable versions are up to and including 1.2.90.
What is the CWE ID for CVE-2023-4161?
The CWE ID for CVE-2023-4161 is 352.
How can I fix the WooCommerce PDF Invoice Builder for WordPress vulnerability (CVE-2023-4161)?
To fix the CVE-2023-4161 vulnerability, update the Rednao Woocommerce Pdf Invoice Builder plugin to version 1.2.91 or later.
- collector/nvd-index
- agent/author
- agent/type
- agent/remedy
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/severity
- agent/weakness
- agent/first-publish-date
- agent/description
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/last-modified-date
- agent/softwarecombine
- agent/tags
- agent/event
- vendor/rednao
- canonical/rednao woocommerce pdf invoice builder
- version/rednao woocommerce pdf invoice builder/1.2.90