CVE-2024-1773: PDF Invoices and Packing Slips For WooCommerce <= 1.3.7 - Authenticated (Subscriber+) PHP Object Injection
The PDF Invoices and Packing Slips For WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.3.7 via deserialization of untrusted input via the orderid parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2024-1773?
CVE-2024-1773 is considered a medium severity vulnerability due to the potential for PHP Object Injection.
How do I fix CVE-2024-1773?
To mitigate CVE-2024-1773, update the PDF Invoices and Packing Slips for WooCommerce plugin to version 1.3.8 or later.
Who is affected by CVE-2024-1773?
CVE-2024-1773 affects users of the PDF Invoices and Packing Slips For WooCommerce plugin prior to version 1.3.8.
What type of attack can occur due to CVE-2024-1773?
Authenticated attackers with subscriber-level access can exploit CVE-2024-1773 through deserialization of untrusted input.
Can CVE-2024-1773 affect my website's security?
Yes, CVE-2024-1773 can compromise the security of your website by allowing unauthorized actions via PHP Object Injection.