CVE-2024-1773Acowebs · Pdf_invoices_and_packing_slips_for_woocommerce
Vulnerability data via NVD (ingested)
The PDF Invoices and Packing Slips For WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.3.7 via deserialization of untrusted input via the order_id parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
External references
Search for exposed instances
Shodan + Censys queries derived from NVD's CPE data. The vuln tag catches assets Shodan has explicitly linked to this CVE; the product / banner fingerprints find exposed instances even when the vuln tag was never applied (which is common).
vuln:CVE-2024-1773http.html:"/wp-content/plugins/pdf-invoices-and-packing-slips-for-woocommerce/"product:"Acowebs Pdf Invoices And Packing Slips For Woocommerce"http.html:"Pdf Invoices And Packing Slips For Woocommerce"More intel sources (5)
vuln:CVE-2024-1773vulnerabilities.cve_id: CVE-2024-1773CVE-2024-1773CVE-2024-1773"CVE-2024-1773" exploit -site:nvd.nist.gov