CVE-2024-3216: 
WordPress vulnerability analysis and mitigation

The WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels plugin for WordPress contains a vulnerability (CVE-2024-3216) that affects all versions up to and including 4.4.2. The vulnerability stems from a missing capability check on the wt_pklist_reset_settings() function, which allows unauthorized access to plugin settings (NVD).

The vulnerability is classified as a Missing Authorization issue (CWE-862) with a CVSS v3.1 Base Score of 5.3 (Medium). The attack vector is network-accessible (AV:N), requires low attack complexity (AC:L), needs no privileges (PR:N), requires no user interaction (UI:N), has unchanged scope (S:U), with no impact on confidentiality (C:N), low impact on integrity (I:L), and no impact on availability (A:N) (NVD).

The vulnerability allows unauthenticated attackers to reset all of the plugin's settings, potentially disrupting the functionality of PDF invoices, packing slips, delivery notes, and shipping labels in WooCommerce installations (NVD).

The vulnerability can be exploited by unauthenticated attackers through network access, requiring low attack complexity and no user interaction (NVD).

Users should upgrade to version 4.4.3 or later of the WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels plugin to address this vulnerability (NVD).