PDF Invoices & Packing Slips for WooCommerce <= 5.16.4 - Unauthenticated Insecure Direct Object Reference to Order Document Disclosure via Document Shortcode
- ID
- WPSEC-2026-1303
- Plugin
- PDF Invoices & Packing Slips for WooCommerce (woocommerce-pdf-invoices-packing-slips)
- Affected
- all versions before 5.16.5
- Remediation
- Update to 5.16.5 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
- Weakness
- CWE-639
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-21
- Attack surface
- PDF Invoices & Packing Slips for WooCommerce on WPSec AttackSurface
- Fix released
- Published
Description
The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference via the document shortcodes in all versions up to, and including, 5.16.4, due to the shortcode only checking order access when the order ID is passed as a shortcode attribute. When the order is taken from the WooCommerce 'order-received' or 'view-order' endpoint URL, no ownership or order key check is done, and the returned document link contains the order key. This makes it possible for unauthenticated attackers to get working invoice and packing slip download links for other customers' orders by changing the order ID in the URL, exposing names, addresses and order details. This works only when the document link access type is set to 'Full' and the shortcode is placed on the checkout or My Account page.
References
- https://wpsec.com/vuln/WPSEC-2026-1303/
- https://plugins.svn.wordpress.org/woocommerce-pdf-invoices-packing-slips/tags/5.16.5/
- https://wordpress.org/plugins/woocommerce-pdf-invoices-packing-slips/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS