Insecure direct object reference in WebToffee WooCommerce PDF plugin
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-639.
Summary
The WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels plugin for WordPress up to and including 5.0.2 has an insecure direct object reference (CWE-639). Guest print access checks only the billing email instead of the WooCommerce order key. An unauthenticated attacker who knows an order ID and billing email can retrieve that customer's invoices and shipping labels, including personal and purchase details, when guest document access is enabled.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Description from the CNA
The WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.0.2 via the 'email' parameter of the guest print_document_from_the_mail_link handler dispatched from print_window() on init. This is due to the handler authorizing access to an order's printable documents when the attacker-supplied (base64-encoded) 'email' equals the order's billing email — a non-secret identifier — instead of requiring the WooCommerce order_key. This makes it possible for unauthenticated attackers, when the site is configured to allow guest access to documents ('wt_pklist_print_button_access_for' != 'logged_in'), to retrieve any other customer's invoice, packing slip, delivery note, dispatch label or shipping label — including customer name, billing/shipping address, phone number, purchased products, prices, taxes and invoice metadata — by knowing the target order ID and the associated billing email address.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| WebToffee | WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels | up to 5.0.2 | — | No fix listed | CNA |
- WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels VendorWebToffee Affected up to 5.0.2 Fixed in — No fix listed CNA
CPE names Threatist (inferred) · 1
Inferred from how NVD named this product before; not given by a source.
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:webtoffee:woocommerce_pdf_invoices\,_packing_slips\,_delivery_notes_and_shipping_labels:*:*:*:*:*:*:*:* | — | — | WebToffee |
- cpe:2.3:a:webtoffee:woocommerce_pdf_invoices\,_packing_slips\,_delivery_notes_and_shipping_labels:*:*:*:*:*:*:*:* Versions — — ·WebToffee
Remediation
No fixed version is listed for WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels. Setting wt_pklist_print_button_access_for to logged_in limits document access to logged-in users.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Timeline
- 2026-10-10 Threatist record created from CVE-2026-93746
- 2026-10-10 Alias added: GHSA-wjmp-g49r-xp3p
- 2026-10-11 Priority changed: MEDIUM → LOW
- 2026-10-11 CISA SSVC decision points changed
References
Other 6
- https://www.wordfence.com/threat-intel/vulnerabilities/id/cf5ccfe6-c0e3-412f-9a93-2ccabb9997e7?source=cve
- https://plugins.trac.wordpress.org/browser/print-invoices-packing-slip-labels-for-woocommerce/tags/5.0.1/admin/class-wf-woocommerce-packing-list-admin.php#L1149
- https://plugins.trac.wordpress.org/browser/print-invoices-packing-slip-labels-for-woocommerce/tags/5.0.1/admin/class-wf-woocommerce-packing-list-admin.php#L1128
- https://plugins.trac.wordpress.org/browser/print-invoices-packing-slip-labels-for-woocommerce/tags/5.0.1/admin/class-wf-woocommerce-packing-list-admin.php#L1127
- https://plugins.trac.wordpress.org/browser/print-invoices-packing-slip-labels-for-woocommerce/tags/5.0.1/admin/class-wf-woocommerce-packing-list-admin.php#L990
- https://plugins.trac.wordpress.org/changeset?reponame=&new=3718644%40print-invoices-packing-slip-labels-for-woocommerce%2Ftags%2F5.0.3&old=3707093%40print-invoices-packing-slip-labels-for-woocommerce%2Ftags%2F5.0.2
More WebToffee vulnerabilities
- TI-2024-07682 GDPR Cookie Consent <= 2.6.0 - Bulk Delete via CSRF CVSS 3.1MEDIUM 6.5
- TI-2024-07785 GDPR Cookie Consent <= 2.6.0 - Unauthenticated Stored XSS CVSS 3.1MEDIUM 5.4
- TI-2024-20216 WordPress Export and Import Users and Customers plugin <= 2.5.2 - Path Traversal vulnerability CVSS 3.1MEDIUM 4.3
- TI-2024-00649 Stripe Payment Plugin for WooCommerce <= 3.7.9 - Unauthenticated SQL Injection CVSS 3.1CRITICAL 9.8
- TI-2023-02962 Stripe Payment Plugin for WooCommerce <= 3.7.7 - Authentication Bypass CVSS 3.1CRITICAL 9.8
- TI-2022-23148 WordPress Product Reviews Import Export for WooCommerce Plugin <= 1.4.8 is vulnerable to CSV Injection CVSS 3.1CRITICAL 9.8
Sources
- CVE-2026-93746 · CVE Program
- CVE-2026-93746 · NVD
- FIRST EPSS
- GHSA-wjmp-g49r-xp3p · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences