High severity · published May 17, 2024
CVE-2023-51546
WordPress WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels plugin <= 4.2.1 - Privilege Escalation vulnerability
7.2
CVSS
0.6%
EPSS
No
On KEV
Description
Improper Privilege Management vulnerability in WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels allows Privilege Escalation.This issue affects WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels: from n/a through 4.2.1.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 51% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WP
WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels · WebToffee
through 4.2.1 · source: vendor, NVD
WP
Woocommerce Pdf Invoices\, Packing Slips\, Delivery Notes And Shipping Labels · Webtoffee
through 4.2.1 · source: CISA
Affected product
WP
WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels
WebToffee
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-51546
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-51546
Third Party Advisory
https://patchstack.com/database/vulnerability/print-invoices-packing-slip-labels-for-woocommerce/wordpress-woocommerce-pdf-invoices-packing-slips-delivery-notes-and-shipping-labels-plugin-4-2-1-privilege-escalation-vulnerability?_s_id=cve
More from WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels
7.5
CVE-2026-49056
WordPress WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels plugin <= 4.9.4 - Sensitive Data Exposure vulnerability
6.5
CVE-2023-7068
WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels <= 4.3.0 - Missing Authorization to Order Export
6.1
CVE-2024-22288
WordPress WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels plugin <= 4.4.0 - Reflected Cross Site Scripting (XSS) vulnerability
6.1
CVE-2024-0957
WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels <= 4.4.1 - Unauthenticated Stored Cross-Site Scripting
5.3
CVE-2024-3216
WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels <= 4.4.2 - Missing Authorization to Unauthenticated Settings Reset