CVE-2023-4245: WooCommerce PDF Invoice Builder <= 1.2.89 - Missing Authorization to Sensitive Information Exposure
The WooCommerce PDF Invoice Builder for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the GetInvoiceDetail function in versions up to, and including, 1.2.89. This makes it possible for subscribers to view arbitrary invoices provided they can guess the order id and invoice id.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2023-4245?
CVE-2023-4245 is a vulnerability in the WooCommerce PDF Invoice Builder for WordPress that allows unauthorized access to data.
What is the severity of CVE-2023-4245?
The severity of CVE-2023-4245 is medium with a score of 4.3.
How does CVE-2023-4245 affect the WooCommerce PDF Invoice Builder plugin?
CVE-2023-4245 affects versions up to and including 1.2.89 of the WooCommerce PDF Invoice Builder plugin.
How can the vulnerability in CVE-2023-4245 be exploited?
The vulnerability in CVE-2023-4245 can be exploited by subscribers who can guess the invoice number to view arbitrary invoices.
Is there a fix available for CVE-2023-4245?
Yes, an update to version 1.2.90 or later of the WooCommerce PDF Invoice Builder plugin fixes the vulnerability.