CVE-2023-4161
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
The WooCommerce PDF Invoice Builder for WordPress is vulnerable to Cross-Site Request Forgery due to a missing nonce check on the SaveCustomField function in versions up to and including 1.2.90. This allows unauthenticated attackers to create invoice fields if they can trick an admin into performing an action such as clicking on a link.
Risk Assessment
Attackers can exploit this vulnerability to manipulate invoice data, potentially leading to financial fraud or data integrity issues within the organization.
Recommendation
It is recommended to update the plugin to the latest version to mitigate this vulnerability and implement additional security measures such as nonce verification in custom functions.
Original NVD description (English source)
The WooCommerce PDF Invoice Builder for WordPress is vulnerable to Cross-Site Request Forgery due to a missing nonce check on the SaveCustomField function in versions up to, and including, 1.2.90. This makes it possible for unauthenticated attackers to create invoice fields provided they can trick an admin into performing an action such as clicking on a link.