PT-2025-5351 · WordPress · Woocommerce Pdf Invoices & Packing Slips

Alexmigf · Published 2025-02-04 · Updated 2025-02-05 · CVE-2025-24373

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions woocommerce-pdf-invoices-packing-slips versions prior to 4.0.0

Description This issue allows unauthorized users to access any PDF document from a store if they have access to a guest document link and replace the URL variable my-account with bulk. The problem occurs when the store's document access is set to "guest" and the user is logged out, compromising the confidentiality of sensitive documents. All stores using the plugin with the guest access option enabled are affected.

Recommendations For versions prior to 4.0.0, upgrade to version 4.0.0 or later to resolve the issue. As a temporary workaround, consider disabling the guest access option to minimize the risk of exploitation. Restrict access to sensitive documents until the issue is resolved.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2025-24373

GHSA-3J9M-CP35-94FR

Affected Products

Woocommerce Pdf Invoices & Packing Slips

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/24xxx/CVE-2025-24373.json · Exploit
• https://github.com/wpovernight/woocommerce-pdf-invoices-packing-slips/commit/6daeff87f8a7f941f0f7cf4637f41d22c4428c30 · Patch
• https://github.com/wpovernight/woocommerce-pdf-invoices-packing-slips/security/advisories/GHSA-3j9m-cp35-94fr · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-24373 · Security Note
• https://osv.dev/vulnerability/CVE-2025-24373 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1887037882084237582 · Twitter Post
• https://twitter.com/CVEnew/status/1886855078750892524 · Twitter Post
• https://t.me/cvedetector/17235 · Telegram Post