CVE-2026-109217
Full vulnerability record from the local CVENow database.
Description
The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.16.5 via the 'invoice_number (via document filename)' parameter. This makes it possible for unauthenticated attackers to extract another customer's complete invoice PDF — including billing identity, shipping address, private order notes, line items, prices, dates, order ID, and invoice number — delivered directly to the attacker's email as an order confirmation attachment. Exploitation requires the plugin's yearly invoice number reset option to be enabled, and the attacker's guest-checkout order must trigger a processing email within 60 seconds of a victim order that shares the same yearly-reset invoice number.
View original CVE JSON
{
"id": "CVE-2026-109217",
"sourceIdentifier": "[email protected]",
"published": "2026-10-31T07:16:34.220",
"lastModified": "2026-10-31T07:16:34.220",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.16.5 via the 'invoice_number (via document filename)' parameter. This makes it possible for unauthenticated attackers to extract another customer's complete invoice PDF — including billing identity, shipping address, private order notes, line items, prices, dates, order ID, and invoice number — delivered directly to the attacker's email as an order confirmation attachment. Exploitation requires the plugin's yearly invoice number reset option to be enabled, and the attacker's guest-checkout order must trigger a processing email within 60 seconds of a victim order that shares the same yearly-reset invoice number."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "wpovernight",
"product": "PDF Invoices & Packing Slips for WooCommerce",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"lessThanOrEqual": "5.16.5",
"versionType": "semver",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 3.9,
"impactScore": 1.4
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-524"
}
]
}
],
"references": [
{
"url": "https://plugins.trac.wordpress.org/browser/woocommerce-pdf-invoices-packing-slips/tags/5.16.4/includes/Documents/Invoice.php#L146",
"source": "[email protected]"
},
{
"url": "https://plugins.trac.wordpress.org/browser/woocommerce-pdf-invoices-packing-slips/tags/5.16.4/includes/Main.php#L181",
"source": "[email protected]"
},
{
"url": "https://plugins.trac.wordpress.org/browser/woocommerce-pdf-invoices-packing-slips/tags/5.16.4/includes/Main.php#L239",
"source": "[email protected]"
},
{
"url": "https://plugins.trac.wordpress.org/browser/woocommerce-pdf-invoices-packing-slips/tags/5.16.4/includes/Main.php#L253",
"source": "[email protected]"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3759839%40woocommerce-pdf-invoices-packing-slips&new=3759839%40woocommerce-pdf-invoices-packing-slips",
"source": "[email protected]"
},
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e68495ad-53ab-4c6b-aecc-1e4bfe34aa0d?source=cve",
"source": "[email protected]"
}
]
}