This vulnerability in the WooCommerce PDF Invoice Builder plugin arises from missing authorization checks, which means that certain actions or data may be accessible without proper permission validation. The issue affects versions up to 1.2.150 and could allow an attacker with limited privileges to access functionality or data that should be restricted. The CVSS vector indicates the attack can be performed remotely over the network with low attack complexity and requires low privileges but no user interaction. The impact is limited to partial confidentiality loss without integrity or availability impact.

The vulnerability allows unauthorized access due to missing authorization controls, which can lead to limited information disclosure (confidentiality impact). There is no indication of integrity or availability impact. The medium CVSS score reflects the moderate risk posed by this issue given the access requirements and impact scope.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should restrict access to the plugin's functionality to trusted users only and monitor for any unusual activity related to invoice generation or access. Avoid exposing the plugin interfaces to untrusted or low-privilege users.