CVE-2026-13116

MediumCVSS 4.3

Published: 11/07/2026(UTC)Updated: 13/07/2026(UTC)Translated: 14/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.22%

13th percentile - higher than 13% of all known CVEs

Summary

The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress up to version 5.14.0 is vulnerable to Insecure Direct Object Reference (IDOR) in the generate_document_shortcode. Missing validation on a user-controlled key allows authenticated attackers with contributor-level access or higher to generate publicly accessible download links for arbitrary third-party orders, exposing sensitive customer data.

Risk Assessment

The organization risks exposure of sensitive customer data including names, addresses, emails, phone numbers, order details, and notes. Attackers can exploit this for identity theft, phishing, or other malicious activities.

Recommendation

Update the plugin to the latest version immediately. If an update is not possible, set the 'Document link access type' setting to 'logged_in' (default) to prevent exploitation.

Other vulnerabilities in PDF Invoices & Packing Slips for WooCommerce

CVE-2026-92244High
The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Billing First Name / Last Name / Company Fields in all versions up to, and including, 5.16.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload survives initial storage because WooCommerce's sanitize_text_field() and wc_clean() do not strip entity-encoded strings containing no literal '<' character, allowing unauthenticated guest-checkout orders to plant the malicious content.

Original NVD description (English source)

The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.14.0 via the generate_document_shortcode due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with contributor-level access and above, to mint publicly accessible, session-free download links for arbitrary third-party orders, exposing customer names, billing and shipping addresses, email addresses, phone numbers, order and invoice numbers, line items, totals, payment details, and customer notes contained in those orders' invoices and packing slips. Exploitation requires the plugin's Document link access type setting to be configured to 'full'; with the default 'logged_in' value, generated URLs are signed with a per-session nonce rather than the order_key, making the shortcode path unexploitable for unauthorized access to third-party orders.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS