Threats tagged 'ghsa-wr2f-frvr-f8hg'

The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress contains an Insecure Direct Object Reference vulnerability in versions up to and including 5.14.0. This flaw allows authenticated users with contributor-level access or higher to generate publicly accessible, session-free download links for invoices and packing slips of arbitrary third-party orders. Exploitation depends on the plugin's Document link access type setting being set to 'full'; the default 'logged_in' setting prevents unauthorized access by using session-bound signed URLs.