Challan
Monthly
Privilege escalation in the WebAppick Challan WordPress plugin (published as PDF Invoice for WooCommerce) version 3.7.88 and earlier allows an authenticated WooCommerce Shop Manager to obtain capabilities beyond the intended Shop Manager role, rated CVSS v3.1 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). Because the vector carries PR:H, only attackers who already hold valid Shop Manager credentials or control a Shop Manager session can reach the flaw; anonymous visitors and self-registered subscriber-level users cannot use it, and WooCommerce must be active on the site for that role to exist at all. No public exploit code or confirmed active exploitation was identified in the provided intelligence at time of analysis.
Privilege escalation in the WebAppick Challan WordPress plugin (published as PDF Invoice for WooCommerce) version 3.7.88 and earlier allows an authenticated WooCommerce Shop Manager to obtain capabilities beyond the intended Shop Manager role, rated CVSS v3.1 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). Because the vector carries PR:H, only attackers who already hold valid Shop Manager credentials or control a Shop Manager session can reach the flaw; anonymous visitors and self-registered subscriber-level users cannot use it, and WooCommerce must be active on the site for that role to exist at all. No public exploit code or confirmed active exploitation was identified in the provided intelligence at time of analysis.