wpovernight PDF Invoices & Packing Slips Plugin up to 5.14.0 on WordPress Document Shortcode class-document-shortcode.php generate_document_shortcode key resource injection

Summaryinfo

A vulnerability was found in wpovernight PDF Invoices & Packing Slips Plugin up to 5.14.0 and classified as problematic. This impacts the function generate_document_shortcode of the file includes/class-document-shortcode.php of the component Document Shortcode Handler. Such manipulation of the argument key leads to resource injection. This vulnerability is listed as CVE-2026-13116. The attack may be performed from remote. There is no available exploit.

Detailsinfo

A vulnerability was found in wpovernight PDF Invoices & Packing Slips Plugin up to 5.14.0. It has been rated as problematic. Affected by this issue is the function generate_document_shortcode of the file includes/class-document-shortcode.php of the component Document Shortcode Handler. The manipulation of the argument key with an unknown input leads to a resource injection vulnerability. Using CWE to declare the problem leads to CWE-99. The product receives input from an upstream component, but it does not restrict or incorrectly restricts the input before it is used as an identifier for a resource that may be outside the intended sphere of control. Impacted is confidentiality. CVE summarizes:

The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.14.0 via the generate_document_shortcode due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with contributor-level access and above, to mint publicly accessible, session-free download links for arbitrary third-party orders, exposing customer names, billing and shipping addresses, email addresses, phone numbers, order and invoice numbers, line items, totals, payment details, and customer notes contained in those orders' invoices and packing slips. Exploitation requires the plugin's Document link access type setting to be configured to 'full'; with the default 'logged_in' value, generated URLs are signed with a per-session nonce rather than the order_key, making the shortcode path unexploitable for unauthorized access to third-party orders.

The advisory is available at wordfence.com. This vulnerability is handled as CVE-2026-13116 since 06/23/2026. The exploitation is known to be easy. The attack may be launched remotely. Technical details are known, but there is no available exploit.

By approaching the search of inurl:includes/class-document-shortcode.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 5.14.0 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-43138). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• WordPress Plugin

Vendor

• wpovernight

Name

• PDF Invoices & Packing Slips Plugin

Version

• 5.0
• 5.1
• 5.2
• 5.3
• 5.4
• 5.5
• 5.6
• 5.7
• 5.8
• 5.9
• 5.10
• 5.11
• 5.12
• 5.13
• 5.14.0

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion