CVE-2026-18027
Received Received - Intake

Directory Traversal in WebToffee WooCommerce PDF Invoices Plugin

Publication date: 2026-08-23

Last updated on: 2026-08-23

Assigner: Wordfence

Description
The WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.9.8 via the get_image_src_in_base64 function. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. The base64-encoded file contents are embedded into the cached invoice HTML and served directly to the attacker via the plugin's own Print/Download invoice endpoints, which require only a valid nonce and access key.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-23
Last Modified
2026-08-23
Generated
2026-08-23
AI Q&A
2026-08-23
EPSS Evaluated
N/A
NVD
CVE-2026-18027
EUVD
EUVD-2026-64606

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
webtoffee woocommerce_pdf_invoices to 4.9.8 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Directory Traversal issue in the WebToffee WooCommerce PDF Invoices plugin for WordPress. It affects versions up to 4.9.8 and is found in the get_image_src_in_base64 function. Authenticated attackers with subscriber-level access or higher can exploit this to read arbitrary files on the server, potentially exposing sensitive data.

Detection Guidance

Check for unauthorized access to sensitive files via the plugin's Print/Download invoice endpoints. Monitor server logs for unusual requests to these endpoints with valid nonces and access keys. Inspect cached invoice HTML files for embedded base64-encoded content that may indicate exploitation.

Impact Analysis

An attacker could access sensitive files on your server, such as configuration files, logs, or other confidential data. This could lead to data breaches, unauthorized access to user information, or further compromise of your WordPress site.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR and HIPAA requirements. Organizations may face legal penalties, reputational damage, and loss of customer trust if such breaches occur due to non-compliance with data protection regulations.

Mitigation Strategies

Update the WebToffee WooCommerce PDF Invoices plugin to the latest version if available. If no update exists, consider disabling the plugin temporarily. Restrict subscriber-level access to sensitive areas and review server file permissions to limit exposure. Monitor for suspicious activity in logs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-18027. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart