CVE-2026-11496
Summary
by MITRE • 09/11/2026
The Woo PDF Invoice Builder plugin (also distributed as "PDF Builder for WooCommerce") for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.8. This is due to the InspectOrder() AJAX handler (woocommerce-pdf-invoice-ajax.php:513), registered on wp_ajax_rednao_wcpdfinv_inspect_order, performing no capability check and no nonce verification before loading an arbitrary order by the attacker-supplied 'OrderNumber' POST field and serializing its full WC_Order::get_data() and meta to the response. This makes it possible for authenticated attackers with Subscriber-level access and above to read every WooCommerce order on the site — including billing/shipping address, email, phone number, payment method, gateway transaction ID, and order totals — by iterating order IDs.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/11/2026
The Woo PDF Invoice Builder plugin, also known as PDF Builder for WooCommerce, contains a critical security vulnerability affecting all versions up to 2.0.8 that allows authenticated attackers with subscriber-level access or higher to perform an Insecure Direct Object Reference attack. This flaw resides within the InspectOrder AJAX handler located in woocommerce-pdf-invoice-ajax.php at line 513 and is registered under the action hook wp_ajax_rednao_wcpdfinv_inspect_order. The core issue stems from a complete absence of capability checks or nonce verification before processing user-supplied input, specifically the OrderNumber field sent via POST requests. This lack of authorization controls enables any authenticated user to bypass intended access restrictions and interact directly with internal order objects without proper validation.
From a technical perspective, the vulnerability exploits the direct exposure of WooCommerce order data through an unvalidated API endpoint. When a request is made, the handler loads an arbitrary WC_Order object based solely on the OrderNumber provided by the attacker. It then serializes the complete dataset returned by get_data() along with associated metadata and transmits this information back to the client in the response payload. Because there are no checks to verify if the requesting user has permission to view the specific order, an attacker can systematically iterate through sequential or known order IDs to harvest sensitive customer information across the entire database of WooCommerce transactions.
The operational impact of this vulnerability is severe due to the breadth and sensitivity of the data exposed. Attackers can retrieve comprehensive details for every order on the site, including billing and shipping addresses, email addresses, phone numbers, payment methods used, gateway transaction IDs, and exact order totals. This constitutes a significant breach of customer privacy and potentially violates regulatory compliance standards such as GDPR or CCPA depending on the jurisdiction. The exposure of financial data like transaction IDs and payment methods also increases the risk of targeted fraud or social engineering attacks against customers whose personal information has been compromised through this automated enumeration process.
This vulnerability aligns with CWE-862, which describes Missing Authorization, as the application fails to enforce proper access controls for a specific resource. It is further categorized under CWE-359, Exposed Private Personal Information, due to the leakage of personally identifiable information and financial data. In terms of offensive security frameworks, this behavior maps directly to ATT&CK technique T1078, Valid Accounts, where an attacker uses legitimate credentials with low privileges to access restricted resources, and T1213, Data from Information Repositories, as they extract structured data from the application's backend systems.
To mitigate this vulnerability, site administrators must immediately update the Woo PDF Invoice Builder plugin to version 2.0.9 or later where these authorization checks have been implemented. Until an update is applied, it is advisable to restrict access to WordPress admin areas using IP whitelisting if possible and to monitor server logs for unusual patterns of AJAX requests targeting the inspect_order endpoint with sequential order numbers. Additionally, implementing a Web Application Firewall can help detect and block automated enumeration attempts by rate-limiting requests from single source IPs that exhibit high-frequency GET or POST activity against this specific handler.