PDF Invoices & Packing Slips CVE-2026-109217

Two specific prerequisites must both hold: (1) the plugin's yearly invoice-number reset option must be enabled, which is a non-default configuration choice by the store operator; and (2) the attacker's guest-checkout order must trigger a 'processing' email within a 60-second window of a victim order that is assigned the same yearly-reset invoice number. Limiting factors that reduce real-world exploitability: the narrow 60-second timing race, the dependency on the non-default yearly-reset setting, the need for a concurrent victim order to collide with, and reliance on the attacker's email actually receiving the misaddressed attachment. No authentication is required (guest checkout), but the timing and configuration constraints make reliable, large-scale exploitation impractical.

This is a genuine but low-urgency issue whose raw CVSS of 5.3 overstates the practical threat. The provided vector (AV:N/AC:L/PR:N/UI:N/C:N/I:L/A:N) treats this as network-reachable and unauthenticated, which matches the guest-checkout entry point, but it is internally inconsistent with the nature of the flaw: this is a Sensitive Information Exposure (CWE-524) that leaks another customer's full invoice PII, so a confidentiality impact (C:L) is expected, yet the official vector scores C:N and instead assigns I:L - that mapping appears incorrect and should be verified with the scoring source. More importantly, AC:L understates the real difficulty: exploitation depends on a non-default configuration (the yearly invoice-number reset must be enabled) AND a tight timing race, where the attacker's guest order must trigger a processing email within 60 seconds of a victim order that happens to share the same yearly-reset invoice number. No EPSS score, no KEV listing, and no confirmed public exploit were supplied, and the vendor-side priority is 'this_month' rather than act_now/emergency. Taken together, the signals point to an opportunistic, hard-to-reliably-weaponize information leak rather than a widely automatable attack - real enough to patch on a normal cycle, but not an emergency.

On a vulnerable store that has the plugin's yearly invoice-number reset enabled, an attacker places a guest-checkout order timed to land within 60 seconds of a victim's order so both are assigned the same yearly-reset invoice number. Because the invoice PDF is addressed by that colliding number (via the document filename), the plugin attaches the victim's complete invoice - billing identity, shipping address, private order notes, line items, prices, and order ID - to the attacker's own order-confirmation email. No public exploit identified at time of analysis, so the attacker must reproduce the race manually.