PDF Invoices & Packing Slips for WooCommerce Plugin Peppol EDI Endpoint resource injection

Summaryinfo

A vulnerability categorized as problematic has been discovered in PDF Invoices & Packing Slips for WooCommerce Plugin up to 5.6.0 on WordPress. Impacted is the function wpo_ips_edi_save_order_customer_peppol_identifiers of the component Peppol EDI Endpoint. Such manipulation of the argument order_id leads to resource injection. This vulnerability is referenced as CVE-2026-1906. It is possible to launch the attack remotely. No exploit is available.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in PDF Invoices & Packing Slips for WooCommerce Plugin up to 5.6.0 on WordPress. Affected by this issue is the function wpo_ips_edi_save_order_customer_peppol_identifiers of the component Peppol EDI Endpoint. The manipulation of the argument order_id with an unknown input leads to a resource injection vulnerability. Using CWE to declare the problem leads to CWE-99. The product receives input from an upstream component, but it does not restrict or incorrectly restricts the input before it is used as an identifier for a resource that may be outside the intended sphere of control. Impacted is integrity. CVE summarizes:

The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.6.0 via the `wpo_ips_edi_save_order_customer_peppol_identifiers` AJAX action due to missing capability checks and order ownership validation. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify Peppol/EDI endpoint identifiers (`peppol_endpoint_id`, `peppol_endpoint_eas`) for any customer by specifying an arbitrary `order_id` parameter on systems using Peppol invoicing. This can affect order routing on the Peppol network and may result in payment disruptions and data leakage.

The advisory is shared for download at wordfence.com. This vulnerability is handled as CVE-2026-1906. The exploitation is known to be easy. The attack may be launched remotely. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 02/18/2026).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• E-Commerce Management Software

Name

• PDF Invoices & Packing Slips for WooCommerce Plugin

Version

• 5.0
• 5.1
• 5.2
• 5.3
• 5.4
• 5.5
• 5.6.0

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion