The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 3.8.0 via the transform() function. This can allow

The SSRF vulnerability in PDF Invoices & Packing Slips for WooCommerce allows an attacker to make requests to any internal service accessible to the web server. This could include accessing administrative panels, databases, or other sensitive resources that are not directly exposed to the internet. Successful exploitation could lead to data breaches, unauthorized access to internal systems, and potentially even remote code execution if internal services are vulnerable. The lack of authentication required for exploitation significantly broadens the attack surface, making it easier for malicious actors to leverage this vulnerability.

WordPress websites utilizing the PDF Invoices & Packing Slips for WooCommerce plugin, particularly those running versions 3.8.0 or earlier, are at risk. Shared hosting environments where multiple websites share the same server infrastructure are especially vulnerable, as an attacker could potentially leverage this vulnerability to access other websites on the same server.

• wordpress / composer / npm:

grep -r 'transform(' /var/www/html/wp-content/plugins/pdf-invoices-packing-slips-for-woocommerce/includes/class-wc-pdf-invoice.php

• generic web:

curl -I https://your-wordpress-site.com/wp-content/plugins/pdf-invoices-packing-slips-for-woocommerce/includes/class-wc-pdf-invoice.php | grep -i 'server' # Check for internal server reveals

1. 2024-05-02Disclosure

   disclosure

1. Réservé2024-03-28
2. Publiée2024-05-02
3. Modifiée2024-08-15
4. EPSS mis à jour2026-04-02

The primary mitigation for CVE-2024-3047 is to upgrade the PDF Invoices & Packing Slips for WooCommerce plugin to a version that includes the security patch. If upgrading immediately is not feasible, consider implementing a Web Application Firewall (WAF) rule to block outbound requests to suspicious internal IP addresses or domains. Additionally, restrict the plugin's access to internal resources by implementing network segmentation and access control lists. Monitor web server logs for unusual outbound requests originating from the plugin.