CVE-2024-1773

Summary

CVE-2024-1773 is a vulnerability affecting the PDF Invoices and Packing Slips For WooCommerce plugin for WordPress. In all versions up to 1.3.7, this plugin is susceptible to PHP Object Injection due to deserialization of untrusted input through the order_id parameter. authenticated attackers with subscriber-level access or higher can inject a PHP Object, potentially leading to file deletion, data exposure, or code execution. However, no known Pop chain exists within the vulnerable plugin itself. The risk is amplified if a Pop chain exists in an additional plugin or theme installed on the target system.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.