{
 "id": "WPSEC-2026-1303",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1303/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1303/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1303/index.md",
 "title": "PDF Invoices & Packing Slips for WooCommerce <= 5.16.4 - Unauthenticated Insecure Direct Object Reference to Order Document Disclosure via Document Shortcode",
 "description": "The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference via the document shortcodes in all versions up to, and including, 5.16.4, due to the shortcode only checking order access when the order ID is passed as a shortcode attribute. When the order is taken from the WooCommerce 'order-received' or 'view-order' endpoint URL, no ownership or order key check is done, and the returned document link contains the order key. This makes it possible for unauthenticated attackers to get working invoice and packing slip download links for other customers' orders by changing the order ID in the URL, exposing names, addresses and order details. This works only when the document link access type is set to 'Full' and the shortcode is placed on the checkout or My Account page.",
 "plugin": {
  "slug": "woocommerce-pdf-invoices-packing-slips",
  "name": "PDF Invoices & Packing Slips for WooCommerce",
  "full_name": "PDF Invoices & Packing Slips for WooCommerce",
  "wordpress_org": "https://wordpress.org/plugins/woocommerce-pdf-invoices-packing-slips/",
  "advisories_url": "https://wpsec.com/vuln/plugin/woocommerce-pdf-invoices-packing-slips/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/woocommerce-pdf-invoices-packing-slips"
 },
 "type": "IDOR",
 "cwe": [
  "CWE-639"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.9,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "5.16.5",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 5.16.5"
  ]
 },
 "introduced_in": null,
 "fixed_in": "5.16.5",
 "remediation": "Update to 5.16.5 or later.",
 "fix_released": "2026-10-20T07:20:17+00:00",
 "published": "2026-10-21T10:43:36+00:00",
 "updated": "2026-10-21T10:35:16.270154+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1303/",
  "https://plugins.svn.wordpress.org/woocommerce-pdf-invoices-packing-slips/tags/5.16.5/",
  "https://wordpress.org/plugins/woocommerce-pdf-invoices-packing-slips/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/woocommerce-pdf-invoices-packing-slips",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-21"
 }
}