CVE-2023-3764

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

The WooCommerce PDF Invoice Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.90. This is due to missing or incorrect nonce validation on the Save function. This makes it possible for unauthenticated attackers to make changes to invoices via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-352

Affected software

No affected versions have been published.

Timeline

Published
Aug 31, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-376445.5SWFTools 0.9.2 772e55a allows attackers to trigger a large memory-allocation attempt via a crafted document, as demonstrated by pdf2swf. ThiCVE-2023-376455.3eyoucms v1.6.3 was discovered to contain an information disclosure vulnerability via the component /custom_model_path/recruit.filelist.txt.CVE-2023-376467.8An issue in the CAB file extraction function of Bitberry File Opener v23.0 allows attackers to execute a directory traversal.CVE-2023-376479.8SEMCMS v1.5 was discovered to contain a SQL injection vulnerability via the id parameter at /Ant_Suxin.php.CVE-2023-376497.5Incorrect access control in the component /models/Content of Cockpit CMS v2.5.2 allows unauthorized attackers to access sensitive data.CVE-2023-376510.0Absolute Path Traversal in GitHub repository mlflow/mlflow prior to 2.5.0.CVE-2023-376508.8A Cross-Site Request Forgery (CSRF) in the Admin portal of Cockpit CMS v2.5.2 allows attackers to execute arbitrary Administrator commands.CVE-2023-376569.8WebsiteGuide v0.2 is vulnerable to Remote Command Execution (RCE) via image upload.CVE-2023-376575.4TwoNav v2.0.28-20230624 is vulnerable to Cross Site Scripting (XSS).CVE-2023-376585.4fast-poster v2.15.0 is vulnerable to Cross Site Scripting (XSS). File upload check binary of img, but without strictly check file suffix at CVE-2023-376599.8xalpha v0.11.4 is vulnerable to Remote Command Execution (RCE).CVE-2023-37665.9A vulnerability was discovered in the odoh-rs rust crate that stems from faulty logic during the parsing of encrypted queries. This issue sp
CVE-2023-3764: Medium severity, CVSS 4.3 | Vulnix