CVE-2024-12210

Name of the Vulnerable Software and Affected Versions Print Invoice & Delivery Notes for WooCommerce plugin for WordPress versions up to, and including, 5.4.0

Description The issue is due to a missing capability check on the wcdn remove shoplogo AJAX action. This makes it possible for authenticated attackers, with Subscriber-level access and above, to remove the shop's logo.

Recommendations For versions up to, and including, 5.4.0, update to a version that includes a fix for the missing capability check on the wcdn remove shoplogo AJAX action. As a temporary workaround, consider disabling the wcdn remove shoplogo AJAX action until a patch is available.