CVE-2026-11496
Received Received - Intake

Insecure Direct Object Reference in Woo PDF Invoice Builder Plugin

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: Wordfence

Description
The Woo PDF Invoice Builder plugin (also distributed as "PDF Builder for WooCommerce") for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.8. This is due to the InspectOrder() AJAX handler (woocommerce-pdf-invoice-ajax.php:513), registered on wp_ajax_rednao_wcpdfinv_inspect_order, performing no capability check and no nonce verification before loading an arbitrary order by the attacker-supplied 'OrderNumber' POST field and serializing its full WC_Order::get_data() and meta to the response. This makes it possible for authenticated attackers with Subscriber-level access and above to read every WooCommerce order on the site — including billing/shipping address, email, phone number, payment method, gateway transaction ID, and order totals — by iterating order IDs.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-11
Last Modified
2026-09-11
Generated
2026-09-11
AI Q&A
2026-09-11
EPSS Evaluated
N/A
NVD
CVE-2026-11496
EUVD
EUVD-2026-75929

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wordfence woo_pdf_invoice_builder to 2.0.8 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an Insecure Direct Object Reference (IDOR) in the Woo PDF Invoice Builder plugin for WordPress. It allows authenticated attackers with Subscriber-level access or higher to read all WooCommerce orders by exploiting a lack of capability checks and nonce verification in the InspectOrder() AJAX handler. Attackers can iterate through order IDs to access sensitive data like billing/shipping addresses, emails, phone numbers, payment details, and order totals.

Detection Guidance

Check for unauthorized access to order data by monitoring logs for requests to wp_ajax_rednao_wcpdfinv_inspect_order with POST data containing OrderNumber. Look for repeated requests with varying order IDs, which may indicate exploitation attempts.

Impact Analysis

If you use this plugin, attackers could steal sensitive customer data including personal information, payment details, and order history. This could lead to privacy breaches, financial fraud, reputational damage, and potential legal consequences for your business.

Compliance Impact

This vulnerability likely violates GDPR due to unauthorized access to personal data and HIPAA if protected health information was exposed. It could result in regulatory fines, mandatory breach notifications, and loss of compliance certifications.

Mitigation Strategies

Update the Woo PDF Invoice Builder plugin to the latest version immediately. If an update is not available, disable the plugin until a patch is released. Review user roles to ensure only necessary permissions are granted, especially for Subscriber-level access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-11496. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart