What is the CVSS score of CVE-2024-54383?

CVE-2024-54383 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 5.3%.

Which versions of WooCommerce PDF Vouchers are affected by CVE-2024-54383?

WordPress installations running WooCommerce PDF Vouchers plugin (versions ≤4.9.8) face critical risk of complete administrative compromise through unauthenticated privilege escalation.

How to fix or mitigate CVE-2024-54383?

24 hours: Inventory all WordPress instances and identify deployment of WooCommerce PDF Vouchers plugin version 4.9.8 or earlier; disable the plugin immediately as interim protection. 7 days: If plugin functionality is business-critical, implement WAF rules blocking HTTP requests to plugin directories and enforce IP allowlisting to administrative interfaces; enable real-time WordPress security monitoring. 30 days: Monitor Patchstack security advisories and wpweb vendor channels for patch release; establish automated patch deployment workflow for immediate rollout when available; evaluate alternative plugins as contingency if patch timeline exceeds 30 days.

WooCommerce PDF Vouchers CVE-2024-54383

CRITICAL

Incorrect Privilege Assignment (CWE-266)

2024-12-18 audit@patchstack.com

WordPress Privilege Escalation Woocommerce Pdf Vouchers Wordpress Plugin Wpwebelite

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVSS changed

Apr 23, 2026 - 15:42 NVD

9.8 (CRITICAL)

CVE Published

Dec 18, 2024 - 19:15 nvd

N/A

DescriptionCVE.org

Incorrect Privilege Assignment vulnerability in wpweb WooCommerce PDF Vouchers woocommerce-pdf-vouchers allows Privilege Escalation.This issue affects WooCommerce PDF Vouchers: from n/a through < 4.9.9.

AnalysisAI

Privilege escalation in the WooCommerce PDF Vouchers WordPress plugin (wpweb) affects all versions up to and including 4.9.8, allowing remote unauthenticated attackers to gain elevated privileges on affected sites due to incorrect privilege assignment. With a CVSS score of 9.8 and EPSS at the 90th percentile (5.34%), this represents a meaningful threat to WordPress sites running this plugin, though no public exploit identified at time of analysis. The vulnerability was reported by Patchstack and impacts the full confidentiality, integrity, and availability triad of affected WordPress installations.

Technical ContextAI

The vulnerability resides in the WooCommerce PDF Vouchers plugin (CPE: cpe:2.3:a:wpwebelite:woocommerce_pdf_vouchers), a WordPress extension for WooCommerce that enables merchants to sell and manage PDF-based gift vouchers. The root cause is classified as CWE-266 (Incorrect Privilege Assignment), meaning the plugin assigns privileges to users or roles in a manner that does not respect the principle of least privilege - typically via flawed capability checks, missing authorization logic on AJAX/REST endpoints, or improper role assignment during user registration or voucher redemption flows. Because the plugin integrates with WordPress's role and capability system as well as WooCommerce's customer/order model, a defect in how it grants or validates privileges can promote a low-privileged or anonymous actor to a higher role such as administrator.

RemediationAI

Upgrade the WooCommerce PDF Vouchers plugin to version 4.9.9 or later, which is the first version not flagged in the affected range - patch availability inferred from the version cutoff stated in the advisory (Patch available per vendor advisory). Until the upgrade is applied, administrators should consider deactivating the WooCommerce PDF Vouchers plugin (this disables voucher sales and redemption functionality but eliminates the attack surface), restricting access to the WordPress site's REST and admin-ajax endpoints via WAF rules to block unauthenticated requests touching plugin routes (note this may break legitimate front-end voucher purchase flows), and auditing existing user accounts for unexpected administrator or shop_manager roles that may indicate prior exploitation. After patching, rotate administrative credentials and review WordPress audit logs.