Read the docs
TI-2025-18116 Aliases CVE-2025-24373

Unrestricted Access to PDF Documents via URL Manipulation in woocommerce-pdf-invoices-packing-slips

Priority LOW 34CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-200.

Summary

woocommerce-pdf-invoices-packing-slips is an extension which allows users to create, print & automatically email PDF invoices & packing slips for WooCommerce orders. This vulnerability allows unauthorized users to access any PDF document from a store if they: 1. Have access to a guest document link and 2. Replace the URL variable `my-account` with `bulk`. The issue occurs when: 1. The store's document access is set to "guest." and 2. The user is logged out. This vulnerability compromises the confidentiality of sensitive documents, affecting all stores using the plugin with the guest access option enabled. This issue has been addressed in version 4.0.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0045 39th percentileScored 2026-11-07
Fix Fixed woocommerce-pdf-invoices-packing-slips (wpovernight): 4.0.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
wpovernightwoocommerce-pdf-invoices-packing-slipsbefore 4.0.04.0.0Patch availableCNA
  • woocommerce-pdf-invoices-packing-slips Vendorwpovernight Affected before 4.0.0 Fixed in 4.0.0 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:wpovernight:woocommerce_pdf_invoices\&_packing_slips:*:*:*:*:*:wordpress:*:*before 4.0.0Vulnerablewpovernight
  • cpe:2.3:a:wpovernight:woocommerce_pdf_invoices\&_packing_slips:*:*:*:*:*:wordpress:*:* Versions before 4.0.0 Vulnerable ·wpovernight

Remediation

  • Fix · CNA woocommerce-pdf-invoices-packing-slips (wpovernight) Fixed in 4.0.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-24373

References

Patch 1

Advisory 1

  • TI-2024-02851 PDF Invoices & Packing Slips for WooCommerce <= 3.8.0 - Unauthenticated Stored Cross-Site Scripting CVSS 3.1HIGH 7.2
  • TI-2024-14748 WordPress WooCommerce PDF Invoices & Packing Slips Plugin <= 3.7.5 is vulnerable to SQL Injection CVSS 3.1HIGH 7.6
  • TI-2024-02853 PDF Invoices & Packing Slips for WooCommerce <= 3.8.0 - Unauthenticated Server-Side Request Forgery CVSS 3.1HIGH 7.2
  • TI-2022-01936 WooCommerce PDF Invoices & Packing Slips < 2.16.0 - Reflected Cross-Site Scripting CVSS 3.1MEDIUM 6.1
  • TI-2017-13679 The woocommerce-pdf-invoices-packing-slips plugin before 2.0.13 for WordPress has XSS via… CVSS 3.0MEDIUM 6.1
  • TI-2022-02344 WooCommerce PDF Invoices & Packing Slips < 3.0.1 - Reflected Cross-Site Scripting CVSS 3.1MEDIUM 6.1
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences