CVE-2025-24373

woocommerce-pdf-invoices-packing-slips is an extension which allows users to create, print & automatically email PDF invoices & packing slips for WooCommerce orders. This vulnerability allows unauthorized users to access any PDF document from a store if they: 1. Have access to a guest document link and 2. Replace the URL variable `my-account` with `bulk`. The issue occurs when: 1. The store's document access is set to "guest." and 2. The user is logged out. This vulnerability compromises the confidentiality of sensitive documents, affecting all stores using the plugin with the guest access option enabled. This issue has been addressed in version 4.0.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

• CWE-200

• https://github.com/wpovernight/woocommerce-pdf-invoices-packing-slips/commit/6daeff87f8a7f941f0f7cf4637f41d22c4428c30Patch
• https://github.com/wpovernight/woocommerce-pdf-invoices-packing-slips/security/advisories/GHSA-3j9m-cp35-94frVendor Advisory

Published

Feb 4, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-24367Cacti is an open source performance and fault management fra…8.8
• CVE-2025-24368Cacti is an open source performance and fault management fra…7.5
• CVE-2025-24369Anubis is a tool that allows administrators to protect bots …2.3
• CVE-2025-24370Django-Unicorn adds modern reactive component functionality …9.3
• CVE-2025-24371CometBFT is a distributed, Byzantine fault-tolerant, determi…7.1
• CVE-2025-24372CKAN is an open-source DMS (data management system) for powe…7.3
• CVE-2025-24374Twig is a template language for PHP. When using the ?? opera…4.3
• CVE-2025-24375Charmed MySQL K8s operator is a Charmed Operator for running…5
• CVE-2025-24376kubewarden-controller is a Kubernetes controller that allows…6.5
• CVE-2025-24377Dell Unity, version(s) 5.4 and prior, contain(s) an Improper…7.8
• CVE-2025-24378Dell Unity, version(s) 5.4 and prior, contain(s) an Improper…7.8
• CVE-2025-24379Dell Unity, version(s) 5.4 and prior, contain(s) an Improper…7.8