CVE-2026-93746

Deferred Deferred - Pending Action

Insecure Direct Object Reference in WebToffee WooCommerce PDF Invoices Plugin

Publication date: 2026-10-10

Last updated on: 2026-10-11

Assigner: Wordfence

Description

The WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.0.2 via the 'email' parameter of the guest print_document_from_the_mail_link handler dispatched from print_window() on init. This is due to the handler authorizing access to an order's printable documents when the attacker-supplied (base64-encoded) 'email' equals the order's billing email — a non-secret identifier — instead of requiring the WooCommerce order_key. This makes it possible for unauthenticated attackers, when the site is configured to allow guest access to documents ('wt_pklist_print_button_access_for' != 'logged_in'), to retrieve any other customer's invoice, packing slip, delivery note, dispatch label or shipping label — including customer name, billing/shipping address, phone number, purchased products, prices, taxes and invoice metadata — by knowing the target order ID and the associated billing email address.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-10

Last Modified

2026-10-11

Generated

2026-10-19

AI Q&A

2026-10-10

EPSS Evaluated

2026-10-18

NVD

CVE-2026-93746

EUVD

EUVD-2026-96289

Affected Vendors & Products

Vendor	Product	Version / Range
webtoffee	WebToffee	WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

This vulnerability is an Insecure Direct Object Reference (IDOR) in the WebToffee WooCommerce PDF Invoices plugin for WordPress. It allows unauthenticated attackers to access other customers' sensitive documents like invoices or shipping labels by manipulating the 'email' parameter. The flaw occurs because the plugin checks for a matching billing email instead of a secure order key to authorize document access.

Detection Guidance

Check WordPress plugin versions for WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels up to 5.0.2. Verify if guest access to documents is enabled ('wt_pklist_print_button_access_for' != 'logged_in'). Test by attempting to access printable documents using an order ID and billing email without authentication.

Impact Analysis

If you use this plugin, attackers could steal sensitive customer data such as names, addresses, phone numbers, purchased products, prices, and tax details. This requires knowing the target order ID and billing email. The impact is higher if your site allows guest access to documents.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to unauthorized access to personally identifiable information (PII) and protected health information (PHI). It violates data protection principles requiring secure handling of sensitive customer data.

Mitigation Strategies

Update the WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels plugin to the latest version, which addresses the insecure direct object reference vulnerability. If an update is not available, consider disabling the plugin temporarily or restricting guest access to printable documents by setting 'wt_pklist_print_button_access_for' to 'logged_in'.

Hi! I’m here to help you understand CVE-2026-93746. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70