Sensitive Information Exposure in PDF Invoices & Packing Slips for WooCommerce

CVE-2026-109217

What is CVE-2026-109217?

The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress contains a vulnerability that allows unauthenticated attackers to access sensitive customer information. This security flaw arises from improper handling of the 'invoice_number' parameter, enabling attackers to retrieve another customer's complete invoice PDF. The issue is exacerbated when the plugin's yearly invoice number reset feature is active, allowing attackers to manipulate processing emails linked to guest-checkout orders. This vulnerability could lead to unauthorized disclosure of billing identities, shipping addresses, private notes, and other confidential order details.

References