CVE-2024-3047: SSRF in PDF Invoices & Packing Slips

The SSRF vulnerability in PDF Invoices & Packing Slips for WooCommerce allows an attacker to make requests to any internal service accessible to the web server. This could include accessing administrative panels, databases, or other sensitive resources that are not directly exposed to the internet. Successful exploitation could lead to data breaches, unauthorized access to internal systems, and potentially even remote code execution if internal services are vulnerable. The lack of authentication required for exploitation significantly broadens the attack surface, making it easier for malicious actors to leverage this vulnerability.

1. Reserved2024-03-28
2. Published2024-05-02
3. Modified2024-08-15
4. EPSS updated2026-04-02

The primary mitigation for CVE-2024-3047 is to upgrade the PDF Invoices & Packing Slips for WooCommerce plugin to a version that includes the security patch. If upgrading immediately is not feasible, consider implementing a Web Application Firewall (WAF) rule to block outbound requests to suspicious internal IP addresses or domains. Additionally, restrict the plugin's access to internal resources by implementing network segmentation and access control lists. Monitor web server logs for unusual outbound requests originating from the plugin.