CVE-2023-4245CWE-862

WooCommerce PDF Invoice Builder <= 1.2.89 - Missing Authorization to Sensitive Information Exposure

Medium · published August 31, 2023

CVSS v3.1
4.3
EPSS
1%
Percentile
44.6
In the wild
Unconfirmed
What it is

The WooCommerce PDF Invoice Builder for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the GetInvoiceDetail function in versions up to, and including, 1.2.89. This makes it possible for subscribers to view arbitrary invoices provided they can guess the order id and invoice id.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00539 · 44.6th percentile
Weakness
CWE-862 · Missing Authorization
Published
2023-08-31T05:33Z
EPSS history
Timeline
  • 31 AUG 05:33Z
    WooCommerce PDF Invoice Builder <= 1.2.89 - Missing Authorization to Sensitive Information Exposure
    cvelistv5