CVE-2024-3047: PDF Invoices & Packing Slips for WooCommerce <= 3.8.0 - Unauthenticated Server-Side Request Forgery
The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 3.8.0 via the transform() function. This can allow unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2024-3047?
CVE-2024-3047 is considered a medium severity vulnerability due to its potential to allow unauthorized web requests.
How do I fix CVE-2024-3047?
To fix CVE-2024-3047, update the WooCommerce PDF Invoices & Packing Slips plugin to version 3.8.1 or later.
Who is affected by CVE-2024-3047?
CVE-2024-3047 affects users of the WooCommerce PDF Invoices & Packing Slips plugin for WordPress versions up to and including 3.8.0.
What type of vulnerability is CVE-2024-3047?
CVE-2024-3047 is categorized as a Server-Side Request Forgery (SSRF) vulnerability.
Can authenticated users exploit CVE-2024-3047?
No, CVE-2024-3047 can be exploited by unauthenticated attackers.