Read the docs
TI-2026-83485 Aliases CVE-2026-109217GHSA-8j84-cw28-3pw7

Information exposure in PDF Invoices & Packing Slips for WooCommerce

Priority LOW 30CWE-524Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · Low · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is affected in all versions up to and including 5.16.5. Its cached invoice attachments can expose another customer's complete invoice PDF (CWE-524). An unauthenticated remote attacker can receive a victim's invoice by email when their own guest-checkout order triggers a processing email within 60 seconds of a victim order that shares the same yearly-reset invoice number. This requires the plugin's yearly invoice number reset option to be enabled.

Written with Claude Haiku 5.5 from the sources below · 2026-10-31

Description from the CNA

The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.16.5 via the 'invoice_number (via document filename)' parameter. This makes it possible for unauthenticated attackers to extract another customer's complete invoice PDF — including billing identity, shipping address, private order notes, line items, prices, dates, order ID, and invoice number — delivered directly to the attacker's email as an order confirmation attachment. Exploitation requires the plugin's yearly invoice number reset option to be enabled, and the attacker's guest-checkout order must trigger a processing email within 60 seconds of a victim order that shares the same yearly-reset invoice number.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00256 17th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
wpovernightPDF Invoices & Packing Slips for WooCommerceup to 5.16.5—No fix listedCNA
  • PDF Invoices & Packing Slips for WooCommerce Vendorwpovernight Affected up to 5.16.5 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for PDF Invoices & Packing Slips for WooCommerce.

Written with Claude Haiku 5.5 from the sources below · 2026-10-31

Timeline

  1. 2026-10-31 Threatist record created from CVE-2026-109217
  2. 2026-10-31 Alias added: GHSA-8j84-cw28-3pw7
  3. 2026-11-05 CISA SSVC decision points changed

References

Other 6

  • TI-2024-02851 PDF Invoices & Packing Slips for WooCommerce <= 3.8.0 - Unauthenticated Stored Cross-Site Scripting CVSS 3.1HIGH 7.2
  • TI-2026-28446 WordPress WooCommerce PDF Invoices & Packing Slips plugin < 5.9.0 - PHP Object Injection vulnerability CVSS 3.1HIGH 7.2
  • TI-2025-18116 Unrestricted Access to PDF Documents via URL Manipulation in woocommerce-pdf-invoices-packing-slips CVSS 4.0MEDIUM 6.3
  • TI-2024-14748 WordPress WooCommerce PDF Invoices & Packing Slips Plugin <= 3.7.5 is vulnerable to SQL Injection CVSS 3.1HIGH 7.6
  • TI-2024-09211 WooCommerce Order Proposal <= 2.0.5 - Authenticated (Shop Manager+) Privilege Escalation via Order Proposal CVSS 3.1HIGH 7.2
  • TI-2024-02853 PDF Invoices & Packing Slips for WooCommerce <= 3.8.0 - Unauthenticated Server-Side Request Forgery CVSS 3.1HIGH 7.2
See all 18 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences