WooCommerce向けPDF請求書プラグインに脆弱性、修正版あり
Summary
WordPressのプラグイン「PDF Invoice for WooCommerce + Drag and Drop Template Builder」に、認証なしでサーバー上のコードを実行されかねない脆弱性が見つかりました。WooCommerceで店を運営している組織は、プラグインの版を確認し、修正版へ更新してください。
AI summary
Produced by SecPulse using an external AI model; it may contain mistakes. Check the original description and references below before acting on it.
WordPressのプラグイン「PDF Invoice for WooCommerce + Drag and Drop Template Builder」に、認証なしでサーバー上のコードを実行されかねない脆弱性が見つかりました。WooCommerceで店を運営している組織は、プラグインの版を確認し、修正版へ更新してください。
Affected packages
| Ecosystem | Package | Affected | Fixed |
|---|---|---|---|
| addonsorg | PDF Invoice for WooCommerce + Drag and Drop Template Builder |
≤ 7.1.1 |
— |
Original description The description as published by the source.
The PDF Invoice for WooCommerce + Drag and Drop Template Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 7.1.1 via the 'customer_note' parameter parameter. This is due to insufficient sanitization of the customer_note checkout field, which is inlined verbatim into invoice HTML, entity-decoded back into a live tag by simplehtmldom, reassembled into raw bytes by mPDF, and passed to unserialize() in _getObjAttr without validation. This makes it possible for unauthenticated attackers to execute code on the server. An unauthenticated attacker can trigger the vulnerable code path on a default install by placing an anonymous WooCommerce checkout via the public Store API (POST /wc/store/v1/checkout) using a Direct Bank Transfer or cheque payment method, which automatically transitions the order to 'on-hold' status and fires the plugin's invoice-generation hook.
Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory