CVE-2023-4161: 
WordPress vulnerability analysis and mitigation

The WooCommerce PDF Invoice Builder WordPress plugin (versions up to and including 1.2.90) contains a Cross-Site Request Forgery (CSRF) vulnerability. The vulnerability was discovered in August 2023 and is tracked as CVE-2023-4161. The issue stems from a missing nonce check in the SaveCustomField function (NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 4.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. The security flaw exists due to the absence of proper security checks (nonce verification) in the SaveCustomField function, which is responsible for creating invoice fields (Wordfence).

The vulnerability allows unauthenticated attackers to create invoice fields in the system if they can trick an administrator into performing specific actions, such as clicking on a malicious link. This could potentially lead to unauthorized modifications of invoice field configurations (NVD).

Users are advised to update their WooCommerce PDF Invoice Builder plugin to a version newer than 1.2.90, which contains the security fix. The vulnerability has been patched by implementing proper nonce checks in the affected function (NVD).