CVE-2024-1773
First published: Thu Mar 07 2024(Updated: )
The PDF Invoices and Packing Slips For WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.3.7 via deserialization of untrusted input via the order_id parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Acowebs PDF Invoices and Packing Slips for WooCommerce | <1.3.8 | |
| WordPress PDF Invoices and Packing Slips For WooCommerce | <=1.3.7 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-1773?
CVE-2024-1773 is considered a medium severity vulnerability due to the potential for PHP Object Injection.
How do I fix CVE-2024-1773?
To mitigate CVE-2024-1773, update the PDF Invoices and Packing Slips for WooCommerce plugin to version 1.3.8 or later.
Who is affected by CVE-2024-1773?
CVE-2024-1773 affects users of the PDF Invoices and Packing Slips For WooCommerce plugin prior to version 1.3.8.
What type of attack can occur due to CVE-2024-1773?
Authenticated attackers with subscriber-level access can exploit CVE-2024-1773 through deserialization of untrusted input.
Can CVE-2024-1773 affect my website's security?
Yes, CVE-2024-1773 can compromise the security of your website by allowing unauthorized actions via PHP Object Injection.
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/first-publish-date
- agent/description
- agent/type
- agent/severity
- agent/author
- agent/event
- agent/source
- agent/remedy
- agent/weakness
- agent/last-modified-date
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- vendor/acowebs
- canonical/acowebs pdf invoices and packing slips for woocommerce
- vendor/woocommerce
- canonical/wordpress pdf invoices and packing slips for woocommerce