CVE-2026-13116
Received Received - Intake

Insecure Direct Object Reference in PDF Invoices & Packing Slips for WooCommerce

Publication date: 2026-07-11

Last updated on: 2026-07-11

Assigner: Wordfence

Description
The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.14.0 via the generate_document_shortcode due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with contributor-level access and above, to mint publicly accessible, session-free download links for arbitrary third-party orders, exposing customer names, billing and shipping addresses, email addresses, phone numbers, order and invoice numbers, line items, totals, payment details, and customer notes contained in those orders' invoices and packing slips. Exploitation requires the plugin's Document link access type setting to be configured to 'full'; with the default 'logged_in' value, generated URLs are signed with a per-session nonce rather than the order_key, making the shortcode path unexploitable for unauthorized access to third-party orders.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-11
Last Modified
2026-07-11
Generated
2026-07-11
AI Q&A
2026-07-11
EPSS Evaluated
N/A
NVD
CVE-2026-13116
EUVD
EUVD-2026-43138

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
woocommerce pdf_invoices_and_packing_slips to 5.14.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress has a vulnerability called Insecure Direct Object Reference (IDOR) in all versions up to and including 5.14.0. This occurs via the generate_document_shortcode due to missing validation on a user-controlled key.

This flaw allows authenticated attackers with contributor-level access or higher to create publicly accessible, session-free download links for arbitrary third-party orders.

These links expose sensitive customer information such as names, billing and shipping addresses, email addresses, phone numbers, order and invoice numbers, line items, totals, payment details, and customer notes contained in those orders' invoices and packing slips.

Exploitation depends on the plugin's Document link access type setting being configured to 'full'. If the default 'logged_in' setting is used, the generated URLs are signed with a per-session nonce, preventing unauthorized access.

Impact Analysis

This vulnerability can lead to unauthorized disclosure of sensitive customer information by allowing attackers to generate public download links for third-party orders without requiring a session.

Exposed data includes personal and payment details such as customer names, addresses, emails, phone numbers, order and invoice numbers, line items, totals, payment details, and customer notes.

Such exposure can result in privacy breaches, potential identity theft, fraud, and loss of customer trust.

Mitigation Strategies

To mitigate this vulnerability, ensure that the plugin's Document link access type setting is not configured to 'full'. The default setting 'logged_in' uses signed URLs with a per-session nonce, which prevents unauthorized access to third-party orders.

Additionally, update the PDF Invoices & Packing Slips for WooCommerce plugin to a version later than 5.14.0 where this issue is fixed.

Compliance Impact

This vulnerability allows authenticated attackers with contributor-level access and above to generate publicly accessible, session-free download links for arbitrary third-party orders. This exposes sensitive customer information including names, billing and shipping addresses, email addresses, phone numbers, order and invoice numbers, line items, totals, payment details, and customer notes.

Exposure of such personal and payment information can lead to non-compliance with data protection regulations such as GDPR and HIPAA, which require the protection of personally identifiable information and sensitive data from unauthorized access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-13116. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart