CVE-2023-3677

HighCVSS 8.8

Published: 31/08/2023(UTC)Updated: 17/06/2026(UTC)Translated: 18/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.62%

45th percentile - higher than 45% of all known CVEs

Summary

The WooCommerce PDF Invoice Builder plugin for WordPress is vulnerable to SQL Injection via the pageId parameter in versions up to and including 1.2.89 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.

Risk Assessment

An attacker with subscriber or higher privileges can append additional SQL queries into existing queries, potentially leading to the extraction of sensitive information from the database.

Recommendation

It is recommended to update the plugin to the latest version to mitigate this vulnerability and review application security to minimize the risk of SQL Injection attacks.

Other vulnerabilities in WooCommerce PDF Invoice Builder plugin

CVE-2023-3764Medium
The WooCommerce PDF Invoice Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to and including 1.2.90. This is due to missing or incorrect nonce validation on the Save function, allowing unauthenticated attackers to make changes to invoices via a forged request.

Original NVD description (English source)

The WooCommerce PDF Invoice Builder plugin for WordPress is vulnerable to SQL Injection via the pageId parameter in versions up to, and including, 1.2.89 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for subscribers or higher to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS