CVE-2026-11899

Received Received - Intake

Authorization Bypass in PDF Builder for WooCommerce

Publication date: 2026-09-19

Last updated on: 2026-09-19

Assigner: Wordfence

Description

The PDF Builder for WooCommerce. Create invoices,packing slips and more plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.0.11. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve invoice numbers, formatted invoice numbers, and creation timestamps for arbitrary WooCommerce orders by supplying any OrderNumber and InvoiceId values with a garbage nonce.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-19

Last Modified

2026-09-19

Generated

2026-09-20

AI Q&A

2026-09-20

EPSS Evaluated

N/A

NVD

CVE-2026-11899

Affected Vendors & Products

Vendor	Product	Version / Range
woocommerce	pdf_builder	to 2.0.11 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability is an authorization bypass in the PDF Builder for WooCommerce plugin for WordPress. It affects versions up to and including 2.0.11. The issue occurs because the plugin does not properly verify user authorization before performing actions. Authenticated attackers with subscriber-level access or higher can exploit this to retrieve sensitive order details like invoice numbers, formatted invoice numbers, and creation timestamps by supplying arbitrary OrderNumber and InvoiceId values with a fake nonce.

Detection Guidance

This vulnerability allows authenticated attackers with subscriber-level access to retrieve sensitive order details. To detect exploitation, check WordPress logs for unauthorized requests to invoice-related endpoints, especially those involving arbitrary OrderNumber and InvoiceId values with invalid nonces. Monitor for unusual access patterns to WooCommerce order data.

Impact Analysis

If you use this plugin, an attacker could access sensitive order information without proper authorization. This includes invoice numbers and timestamps, which could be used for further attacks or to gather business intelligence. The impact is limited to data exposure since no modification or deletion of data is possible through this vulnerability.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to unauthorized access to personal and sensitive data. GDPR requires protection of personal data, and HIPAA mandates safeguards for protected health information. Exposure of such data through this flaw may result in violations and potential penalties.

Mitigation Strategies

Update the PDF Builder for WooCommerce plugin to the latest version beyond 2.0.11 to address the authorization bypass vulnerability. Ensure all users follow the principle of least privilege by restricting subscriber-level access and above to only necessary functions.

Hi! I’m here to help you understand CVE-2026-11899. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70