Now officially on WordPress.org

CVE Database / CVE-2024-22147

CVE · High

CVE-2024-22147 — PDF Invoices & Packing Slips for WooCommerce [woocommerce-pdf-invoices-packing-slips] < 3.7.6

CVE Vulnerability Type Severity Affected Fixed in Published Status
CVE-2024-22147 PDF Invoices & Packing Slips for WooCommerce [woocommerce-pdf-invoices-packing-slips] < 3.7.6 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') High 7.6 < 3.7.6 3.7.6 2024-01-12 —

CVE-2024-22147

The PDF Invoices & Packing Slips for WooCommerce plugin contains a SQL injection vulnerability in the get_numbers() function affecting versions through 3.7.6. Authenticated users with shop manager privileges or higher can exploit inadequately escaped user input to inject malicious SQL commands, allowing them to execute unauthorized database queries and access sensitive data. The vulnerability stems from improper input escaping and insufficient query preparation in the affected function.

Based on public CVE data (MITRE/NVD).

Scan your WordPress site free

No signup, no credit card — enter your URL and get a security report in seconds.

Run a free scan Get the plugin (free)

See the full security page for this plugin Browse the CVE database Browse all security findings