Vulnerabilities / Faktur Pro for WooCommerce / WPSEC-2026-1600
Faktur Pro for WooCommerce <= 3.2.2 - Authenticated (Customer+) Insecure Direct Object Reference to Customer Invoice Download via 'order' Parameter
Medium 4.3
CWE-639Fixed in 3.2.3
- ID
- WPSEC-2026-1600
- Plugin
- Faktur Pro for WooCommerce (woorechnung)
- Affected
- all versions before 3.2.3
- Remediation
- Update to 3.2.3 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-639
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-25
- Attack surface
- Faktur Pro for WooCommerce on WPSec AttackSurface
- Fix released
- Published
Description
The Faktur Pro for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference via the 'order' parameter of the fakturpro_customer_invoice AJAX action in all versions up to, and including, 3.2.2, due to the handler checking only a generic, non-order-specific nonce and not validating that the requested order belongs to the current user. This makes it possible for authenticated attackers, with customer-level access and above, to download the invoice PDFs of other customers' orders, exposing their names, addresses and order details.
References
- https://wpsec.com/vuln/WPSEC-2026-1600/
- https://plugins.svn.wordpress.org/woorechnung/tags/3.2.3/
- https://wordpress.org/plugins/woorechnung/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS