PT-2026-20290 · WordPress+1 · Woocommerce Pdf Invoices & Packing Slips+1
CVSS v3.1
4.3
Média
| Vetor | AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
PDF Invoices & Packing Slips for WooCommerce versions up to and including 5.6.0
Description
The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is susceptible to an Insecure Direct Object Reference issue. This is due to missing capability checks and order ownership validation in the
wpo ips edi save order customer peppol identifiers AJAX action. Authenticated attackers with Subscriber-level access or higher can modify Peppol/EDI endpoint identifiers (peppol endpoint id, peppol endpoint eas) for any customer by manipulating the order id parameter. This could disrupt order routing on the Peppol network and potentially lead to payment disruptions and data leakage.Recommendations
Versions prior to and including 5.6.0 should be updated.
Correção
Missing Authorization
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Woocommerce Pdf Invoices & Packing Slips
Woocommerce