Refine your search

5 vulnerabilities found for WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels by webtoffee

CVE-2026-93746 (GCVE-0-2026-93746)
Vulnerability from cvelistv5
Published
2026-10-10 07:41
Modified
2026-10-11 16:55
Severity ?
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CWE
  • CWE-639 - Authorization Bypass Through User-Controlled Key
Summary
The WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.0.2 via the 'email' parameter of the guest print_document_from_the_mail_link handler dispatched from print_window() on init. This is due to the handler authorizing access to an order's printable documents when the attacker-supplied (base64-encoded) 'email' equals the order's billing email — a non-secret identifier — instead of requiring the WooCommerce order_key. This makes it possible for unauthenticated attackers, when the site is configured to allow guest access to documents ('wt_pklist_print_button_access_for' != 'logged_in'), to retrieve any other customer's invoice, packing slip, delivery note, dispatch label or shipping label — including customer name, billing/shipping address, phone number, purchased products, prices, taxes and invoice metadata — by knowing the target order ID and the associated billing email address.
References
Impacted products
Vendor Product Version
webtoffee WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels Version: 0   ≤ 5.0.2
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-93746",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-11T16:37:08.285423Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-11T16:55:15.249Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes \u0026 Shipping Labels",
          "vendor": "webtoffee",
          "versions": [
            {
              "lessThanOrEqual": "5.0.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Brian Mungai"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes \u0026 Shipping Labels plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.0.2 via the \u0027email\u0027 parameter of the guest print_document_from_the_mail_link handler dispatched from print_window() on init. This is due to the handler authorizing access to an order\u0027s printable documents when the attacker-supplied (base64-encoded) \u0027email\u0027 equals the order\u0027s billing email \u2014 a non-secret identifier \u2014 instead of requiring the WooCommerce order_key. This makes it possible for unauthenticated attackers, when the site is configured to allow guest access to documents (\u0027wt_pklist_print_button_access_for\u0027 != \u0027logged_in\u0027), to retrieve any other customer\u0027s invoice, packing slip, delivery note, dispatch label or shipping label \u2014 including customer name, billing/shipping address, phone number, purchased products, prices, taxes and invoice metadata \u2014 by knowing the target order ID and the associated billing email address."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639 Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-10T07:41:48.536Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/cf5ccfe6-c0e3-412f-9a93-2ccabb9997e7?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/print-invoices-packing-slip-labels-for-woocommerce/tags/5.0.1/admin/class-wf-woocommerce-packing-list-admin.php#L1149"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/print-invoices-packing-slip-labels-for-woocommerce/tags/5.0.1/admin/class-wf-woocommerce-packing-list-admin.php#L1128"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/print-invoices-packing-slip-labels-for-woocommerce/tags/5.0.1/admin/class-wf-woocommerce-packing-list-admin.php#L1127"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/print-invoices-packing-slip-labels-for-woocommerce/tags/5.0.1/admin/class-wf-woocommerce-packing-list-admin.php#L990"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026new=3718644%40print-invoices-packing-slip-labels-for-woocommerce%2Ftags%2F5.0.3\u0026old=3707093%40print-invoices-packing-slip-labels-for-woocommerce%2Ftags%2F5.0.2"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-18T16:22:09.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-10-09T19:11:05.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes \u0026 Shipping Labels \u003c= 5.0.2 - Insecure Direct Object Reference to Unauthenticated Unauthorized Order Document Access via \u0027email\u0027 Parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-93746",
    "datePublished": "2026-10-10T07:41:48.536Z",
    "dateReserved": "2026-09-18T16:07:05.185Z",
    "dateUpdated": "2026-10-11T16:55:15.249Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-18027 (GCVE-0-2026-18027)
Vulnerability from cvelistv5
Published
2026-08-22 23:27
Modified
2026-08-24 13:01
Severity ?
6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CWE
  • CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Summary
The WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.9.8 via the get_image_src_in_base64 function. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. The base64-encoded file contents are embedded into the cached invoice HTML and served directly to the attacker via the plugin's own Print/Download invoice endpoints, which require only a valid nonce and access key.
References
Impacted products
Vendor Product Version
webtoffee WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels Version: 0   ≤ 4.9.8
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-18027",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-24T12:37:46.250703Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-24T13:01:19.729Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes \u0026 Shipping Labels",
          "vendor": "webtoffee",
          "versions": [
            {
              "lessThanOrEqual": "4.9.8",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "daroo"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes \u0026 Shipping Labels plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.9.8 via the get_image_src_in_base64 function. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. The base64-encoded file contents are embedded into the cached invoice HTML and served directly to the attacker via the plugin\u0027s own Print/Download invoice endpoints, which require only a valid nonce and access key."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-22T23:27:19.268Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a46f270f-d9cb-4bc1-8e10-3fc6646e1d78?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/print-invoices-packing-slip-labels-for-woocommerce/tags/4.9.8/admin/modules/customizer/customizer.php#L1561"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/print-invoices-packing-slip-labels-for-woocommerce/tags/4.9.8/admin/modules/customizer/customizer.php#L1607"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/print-invoices-packing-slip-labels-for-woocommerce/tags/4.9.8/admin/modules/customizer/classes/class-customizer.php#L1453"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/print-invoices-packing-slip-labels-for-woocommerce/tags/4.9.8/public/modules/invoice/invoice.php#L1934"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3646629/print-invoices-packing-slip-labels-for-woocommerce"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-08-06T08:41:52.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-08-22T10:37:45.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes \u0026 Shipping Labels \u003c= 4.9.8 - Authenticated (Subscriber+) Arbitrary File Read via \u0027customer_note\u0027 Parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-18027",
    "datePublished": "2026-08-22T23:27:19.268Z",
    "dateReserved": "2026-07-28T05:50:17.888Z",
    "dateUpdated": "2026-08-24T13:01:19.729Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-3216 (GCVE-0-2024-3216)
Vulnerability from cvelistv5
Published
2024-04-06 03:24
Modified
2026-04-08 17:15
Severity ?
5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CWE
Summary
The WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wt_pklist_reset_settings() function in all versions up to, and including, 4.4.2. This makes it possible for unauthenticated attackers to reset all of the plugin's settings.
References
Impacted products
Vendor Product Version
webtoffee WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels Version: 0   ≤ 4.4.2
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T20:05:08.295Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/aeac9c4a-0754-4fb1-bf11-0cd8483451b6?source=cve"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://plugins.trac.wordpress.org/browser/print-invoices-packing-slip-labels-for-woocommerce/trunk/admin/class-wf-woocommerce-packing-list-admin.php#L4262"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:webtoffee:woocommerce_pdf_invoices\\,_packing_slips\\,_delivery_notes_and_shipping_labels:*:*:*:*:*:wordpress:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "woocommerce_pdf_invoices\\,_packing_slips\\,_delivery_notes_and_shipping_labels",
            "vendor": "webtoffee",
            "versions": [
              {
                "lessThanOrEqual": "4.4.2",
                "status": "affected",
                "version": "0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-3216",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-04-08T20:09:30.609508Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-08T19:49:21.881Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes \u0026 Shipping Labels",
          "vendor": "webtoffee",
          "versions": [
            {
              "lessThanOrEqual": "4.4.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Krzysztof Zaj\u0105c"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wt_pklist_reset_settings() function in all versions up to, and including, 4.4.2. This makes it possible for unauthenticated attackers to reset all of the plugin\u0027s settings."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-08T17:15:25.743Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/aeac9c4a-0754-4fb1-bf11-0cd8483451b6?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/print-invoices-packing-slip-labels-for-woocommerce/trunk/admin/class-wf-woocommerce-packing-list-admin.php#L4262"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2024-04-05T00:00:00.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels \u003c= 4.4.2 - Missing Authorization to Unauthenticated Settings Reset"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2024-3216",
    "datePublished": "2024-04-06T03:24:44.171Z",
    "dateReserved": "2024-04-02T17:45:51.078Z",
    "dateUpdated": "2026-04-08T17:15:25.743Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-0957 (GCVE-0-2024-0957)
Vulnerability from cvelistv5
Published
2024-03-22 02:00
Modified
2026-04-08 17:21
Severity ?
6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CWE
  • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Summary
The WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Customer Notes field in all versions up to, and including, 4.4.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected invoice for printing.
References
Impacted products
Vendor Product Version
webtoffee WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels Version: 0   ≤ 4.4.1
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-0957",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-03-29T13:51:57.382451Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:59:20.988Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T18:26:28.962Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c7ba4218-5b60-4e72-b98d-7c95c9fc3d59?source=cve"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=3050923%40print-invoices-packing-slip-labels-for-woocommerce\u0026new=3050923%40print-invoices-packing-slip-labels-for-woocommerce\u0026sfp_email=\u0026sfph_mail="
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes \u0026 Shipping Labels",
          "vendor": "webtoffee",
          "versions": [
            {
              "lessThanOrEqual": "4.4.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Colin Xu"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Customer Notes field in all versions up to, and including, 4.4.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected invoice for printing."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-08T17:21:27.914Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c7ba4218-5b60-4e72-b98d-7c95c9fc3d59?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=3050923%40print-invoices-packing-slip-labels-for-woocommerce\u0026new=3050923%40print-invoices-packing-slip-labels-for-woocommerce\u0026sfp_email=\u0026sfph_mail="
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2024-03-21T00:00:00.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels \u003c= 4.4.1 - Unauthenticated Stored Cross-Site Scripting"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2024-0957",
    "datePublished": "2024-03-22T02:00:00.179Z",
    "dateReserved": "2024-01-26T16:54:44.179Z",
    "dateUpdated": "2026-04-08T17:21:27.914Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2023-7068 (GCVE-0-2023-7068)
Vulnerability from cvelistv5
Published
2024-01-03 08:29
Modified
2026-04-08 16:55
Severity ?
4.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CWE
Summary
The WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on theprint_packinglist action in all versions up to, and including, 4.3.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to export orders which can contain sensitive information.
References
Impacted products
Vendor Product Version
webtoffee WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels Version: 0   ≤ 4.3.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T08:50:07.883Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5abc282d-68c9-423c-a15c-d4d3f7035661?source=cve"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=3014977%40print-invoices-packing-slip-labels-for-woocommerce\u0026new=3014977%40print-invoices-packing-slip-labels-for-woocommerce\u0026sfp_email=\u0026sfph_mail="
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-7068",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-06-17T13:49:25.785191Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-06-17T13:49:37.551Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes \u0026 Shipping Labels",
          "vendor": "webtoffee",
          "versions": [
            {
              "lessThanOrEqual": "4.3.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Lucio S\u00e1"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on theprint_packinglist action in all versions up to, and including, 4.3.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to export orders which can contain sensitive information."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-08T16:55:13.380Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5abc282d-68c9-423c-a15c-d4d3f7035661?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=3014977%40print-invoices-packing-slip-labels-for-woocommerce\u0026new=3014977%40print-invoices-packing-slip-labels-for-woocommerce\u0026sfp_email=\u0026sfph_mail="
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2024-01-02T00:00:00.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels \u003c= 4.3.0 - Missing Authorization to Order Export"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2023-7068",
    "datePublished": "2024-01-03T08:29:48.196Z",
    "dateReserved": "2023-12-21T20:54:43.255Z",
    "dateUpdated": "2026-04-08T16:55:13.380Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}