Insecure Direct Object Reference in WooCommerce Plugin by WordPress

CVE-2026-1906

What is CVE-2026-1906?

The WooCommerce PDF Invoices & Packing Slips plugin is susceptible to an Insecure Direct Object Reference vulnerability that affects all versions up to and including 5.6.0. This flaw arises from inadequate capability checks and the lack of order ownership validation within the wpo_ips_edi_save_order_customer_peppol_identifiers AJAX action. Authenticated attackers with Subscriber-level access or greater can exploit this vulnerability to alter Peppol/EDI endpoint identifiers by specifying arbitrary order_id parameters. This unauthorized modification poses a risk of disrupting order routing on the Peppol network, leading to potential payment issues and risks of data exposure.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References