The flaw is a classic Cross‑Site Request Forgery (CSRF) condition that allows an attacker to trigger the Flexible PDF Invoices module to create or modify invoices without the victim’s consent. A malicious site could craft a forged request that, when executed by a logged‑in administrator or shop manager, would generate invoices, potentially leading to spoofed billing records or unauthorized exploitation of the invoicing logic.

The vulnerable component is the wpdesk Flexible PDF Invoices for WooCommerce & WordPress plugin, versions up through 6.0.13. Any WordPress installation running these releases is at risk when the plugin is enabled.

The CVSS base score of 7.1 indicates a high severity for the impact on application integrity. The EPSS score of less than 1% reflects a very low current exploitation probability, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no known public exploitation. Based on the description it is inferred that the exploit requires a victim who is authenticated to the site, exposing the vulnerability to browsers that automatically attach the session cookie to forged requests sent from a third‑party site.