Insecure Direct Object Reference in WebToffee WooCommerce PDF Invoices Plugin for WordPress

CVE-2026-93746

What is CVE-2026-93746?

The WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels plugin suffers from an insecure direct object reference vulnerability. This security flaw exists in versions up to and including 5.0.2, where an attacker can exploit the 'email' parameter within the guest print document handler. By supplying a base64-encoded email address that matches the billing email of an order, unauthorized users can gain access to sensitive customer documents such as invoices, packing slips, and shipping labels. This issue is particularly critical when the site allows guest access, enabling attackers to retrieve details like customer names, addresses, and purchased items without proper authorization.

References