CVE-2026-93746 in PDF Invoices Packing Slips Delivery Notes & Shipping Labels Plugin
Summary
by MITRE • 10/10/2026
The WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.0.2 via the 'email' parameter of the guest print_document_from_the_mail_link handler dispatched from print_window() on init. This is due to the handler authorizing access to an order's printable documents when the attacker-supplied (base64-encoded) 'email' equals the order's billing email — a non-secret identifier — instead of requiring the WooCommerce order_key. This makes it possible for unauthenticated attackers, when the site is configured to allow guest access to documents ('wt_pklist_print_button_access_for' != 'logged_in'), to retrieve any other customer's invoice, packing slip, delivery note, dispatch label or shipping label — including customer name, billing/shipping address, phone number, purchased products, prices, taxes and invoice metadata — by knowing the target order ID and the associated billing email address.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/10/2026
The vulnerability identified in WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels versions up to 5.0.2 represents a critical failure in access control mechanisms within WordPress e-commerce environments. This flaw is classified as an Insecure Direct Object Reference, commonly referred to by the CWE identifier CWE-639. The core issue lies in how the plugin handles authentication and authorization for accessing sensitive order documents through its guest print functionality. Specifically, the handler responsible for dispatching printable documents from mail links relies on a flawed validation logic that permits unauthenticated users to retrieve confidential data under specific configuration conditions.
The technical root cause of this vulnerability is located within the init action hook where the function print_window() invokes the guest_print_document_from_the_mail_link handler. This handler determines whether access should be granted by comparing an attacker-supplied email address, which is transmitted via a base64-encoded parameter named 'email', against the billing email address associated with a specific WooCommerce order ID provided in the request. The system incorrectly treats the billing email as a sufficient secret for authorization purposes. In modern security architecture, personally identifiable information such as email addresses is considered public or semi-public data rather than a secure credential. By relying on this non-secret identifier instead of requiring a robust, unpredictable token like the WooCommerce order_key, the application fails to enforce proper access control policies.
The operational impact of this vulnerability is severe for businesses utilizing the affected plugin when guest access to documents is enabled. If the site configuration allows guests to print documents, indicated by the setting 'wt_pklist_print_button_access_for' not being set to 'logged_in', an unauthenticated attacker can exploit this flaw. By knowing a target customer's order ID and their associated billing email address, which are often visible in public-facing order confirmation emails or potentially leaked through other means, the attacker can construct malicious requests to retrieve any printable document linked to that order. This includes invoices, packing slips, delivery notes, dispatch labels, and shipping labels.
The data exposed by this vulnerability constitutes a significant privacy breach and potential compliance violation. The retrieved documents contain highly sensitive customer information including full names, billing and shipping addresses, phone numbers, detailed lists of purchased products with prices, tax calculations, and various invoice metadata. This exposure not only violates the trust placed in e-commerce platforms but also exposes customers to risks such as identity theft, physical security threats through address disclosure, and targeted phishing attacks using accurate order details. For organizations subject to regulations like GDPR or CCPA, this constitutes a reportable data breach due to the unauthorized access of personal identifiable information.
From an offensive security perspective, this vulnerability aligns with several techniques in the MITRE ATT&CK framework. It primarily falls under T1078 Valid Accounts if viewed through the lens of credential misuse, but more accurately maps to T1539 Steal Web Session Cookie or generally to unauthorized access patterns where valid-looking requests are crafted without proper authentication. The exploitation method involves manipulating object references (CWE-639) and potentially leveraging information disclosure (CWE-200) to gather the necessary email addresses for further attacks. Attackers can use this data as a foundation for more sophisticated social engineering campaigns or account takeover attempts by verifying valid customer details against other services.
Mitigation strategies must address both immediate remediation and long-term architectural improvements. The most effective solution is to upgrade the WebToffee WooCommerce PDF Invoices plugin to version 5.0.3 or later, where this authorization logic has been corrected to require a secure order key rather than relying on email addresses for access control. For sites that cannot immediately update due to compatibility constraints, administrators should disable guest printing by setting 'wt_pklist_print_button_access_for' to 'logged_in', thereby restricting document access exclusively to authenticated users who have already passed through WooCommerce's standard authentication checks. Additionally, organizations should review their data handling practices and ensure that sensitive order details are not unnecessarily exposed in public-facing contexts or email templates where they might be intercepted by third parties. Regular security audits of plugin configurations and adherence to the principle of least privilege will further reduce the attack surface for similar vulnerabilities in WordPress ecosystems.