CVE-2024-12210

Summary

CVE-2024-12210 is a vulnerability affecting the Print Invoice & Delivery Notes plugin for WordPress, specifically versions up to and including 5.4.0. This issue permits authenticated attackers with Subscriber-level access or higher to bypass capability checks, enabling unauthorized data modification. The affected component, the 'wcdn_remove_shoplogo' AJAX action, lacks the necessary security checks, allowing attackers to remove the shop's logo from invoices. This vulnerability can potentially lead to compromised branding and loss of trust for the affected e-commerce sites.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.