CVE-2023-4245
First published: Thu Aug 31 2023(Updated: )
The WooCommerce PDF Invoice Builder for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the GetInvoiceDetail function in versions up to, and including, 1.2.89. This makes it possible for subscribers to view arbitrary invoices provided they can guess the order id and invoice id.
Credit: security@wordfence.com security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Rednao Woocommerce Pdf Invoice Builder | <=1.2.89 | |
| <=1.2.89 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://plugins.trac.wordpress.org/browser/woo-pdf-invoice-builder/trunk/woocommerce-pdf-invoice-ajax.php#L425
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2955112%40woo-pdf-invoice-builder%2Ftrunk&old=2953379%40woo-pdf-invoice-builder%2Ftrunk&sfp_email=&sfph_mail=#file1
- https://www.wordfence.com/threat-intel/vulnerabilities/id/200fbfc1-df21-43b0-8eb1-b2ba0cc0c0df?source=cve
Frequently Asked Questions
What is CVE-2023-4245?
CVE-2023-4245 is a vulnerability in the WooCommerce PDF Invoice Builder for WordPress that allows unauthorized access to data.
What is the severity of CVE-2023-4245?
The severity of CVE-2023-4245 is medium with a score of 4.3.
How does CVE-2023-4245 affect the WooCommerce PDF Invoice Builder plugin?
CVE-2023-4245 affects versions up to and including 1.2.89 of the WooCommerce PDF Invoice Builder plugin.
How can the vulnerability in CVE-2023-4245 be exploited?
The vulnerability in CVE-2023-4245 can be exploited by subscribers who can guess the invoice number to view arbitrary invoices.
Is there a fix available for CVE-2023-4245?
Yes, an update to version 1.2.90 or later of the WooCommerce PDF Invoice Builder plugin fixes the vulnerability.
- collector/nvd-index
- agent/author
- agent/type
- agent/remedy
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/severity
- agent/references
- agent/description
- agent/first-publish-date
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/last-modified-date
- agent/softwarecombine
- agent/tags
- agent/event
- vendor/rednao
- canonical/rednao woocommerce pdf invoice builder
- version/rednao woocommerce pdf invoice builder/1.2.89