CVE-2024-3216 is a missing authorization vulnerability (CWE-862) in the WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels WordPress plugin. The issue arises because the wt_pklist_reset_settings() function does not perform a capability check, enabling unauthenticated users to reset the plugin's settings. This affects all versions up to 4.4.2. The vulnerability has a CVSS 3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), reflecting a network attack vector with low complexity and no privileges required, resulting in integrity impact but no confidentiality or availability impact.

An unauthenticated attacker can reset all settings of the affected plugin, potentially disrupting configuration and operation of the WooCommerce PDF Invoices and related features. There is no direct confidentiality or availability impact reported. No known exploits are currently observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting access to the affected plugin's functionality or monitoring for unauthorized changes to plugin settings. Do not rely on generic mitigations as the vulnerability specifically involves missing authorization checks in the reset settings function.