CVE-2023-4161

Name of the Vulnerable Software and Affected Versions WooCommerce PDF Invoice Builder for WordPress versions up to, and including, 1.2.90

Description The issue is related to a missing nonce check on the SaveCustomField function, making it possible for unauthenticated attackers to create invoice fields by tricking an admin into performing an action, such as clicking on a link. This is a Cross-Site Request Forgery issue.

Recommendations For versions up to, and including, 1.2.90, update to a version that includes a fix for the missing nonce check on the SaveCustomField function. As a temporary workaround, consider restricting access to the SaveCustomField function until a patch is available.