What is the CVSS score of CVE-2026-13116?

CVE-2026-13116 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

WooCommerce PDF Invoices CVE-2026-13116

EUVD-2026-43138 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-07-11 Wordfence

GHSA-wr2f-frvr-f8hg

WordPress Authentication Bypass Wordpress Plugin Pdf Invoices Packing Slips For Woocommerce Wpovernight

4.3

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Network-reachable shortcode requires contributor auth (PR:L); non-default config is a site precondition, not attacker complexity (AC:L); confidentiality impact is partial, limited to order document data (C:L).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 11, 2026 - 05:12 vuln.today

CVE Published

Jul 11, 2026 - 03:44 cve.org

MEDIUM 4.3

DescriptionCVE.org

The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.14.0 via the generate_document_shortcode due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with contributor-level access and above, to mint publicly accessible, session-free download links for arbitrary third-party orders, exposing customer names, billing and shipping addresses, email addresses, phone numbers, order and invoice numbers, line items, totals, payment details, and customer notes contained in those orders' invoices and packing slips. Exploitation requires the plugin's Document link access type setting to be configured to 'full'; with the default 'logged_in' value, generated URLs are signed with a per-session nonce rather than the order_key, making the shortcode path unexploitable for unauthorized access to third-party orders.

AnalysisAI

Insecure Direct Object Reference in the PDF Invoices & Packing Slips for WooCommerce plugin (versions through 5.14.0) allows authenticated contributors to mint permanent, session-free download links for arbitrary third-party orders, exposing customer PII including names, billing and shipping addresses, email addresses, phone numbers, line items, payment details, and customer notes. Exploitation is gated on a non-default plugin setting - the 'Document link access type' must be configured to 'full' rather than the default 'logged_in'; the default configuration signs URLs with a per-session nonce, neutralising the attack path. No public exploit code or active exploitation has been identified at time of analysis.

Technical ContextAI

The affected component is the generate_document_shortcode handler in the WP Overnight plugin (CPE: cpe:2.3:a:wpovernight:pdf_invoices_&_packing_slips_for_woocommerce:*:*:*:*:*:*:*:*), which generates downloadable invoice and packing slip documents for WooCommerce orders inside a WordPress installation. CWE-639 (Authorization Bypass Through User-Controlled Key) describes the root cause: the shortcode accepts a user-supplied key parameter that maps to an order without performing an ownership or capability check to confirm the requesting user is entitled to that specific order. When the plugin's link access type is 'full', the generated URL embeds the WooCommerce order_key directly and requires no session; an authenticated contributor who can invoke the shortcode can therefore supply any order's key and produce a publicly accessible, persistent link to documents belonging to a different customer. The vulnerable logic is confirmed present in both the 5.9.2 and 5.14.0 tagged releases at Frontend.php:L271, Frontend.php:L284, and Endpoint.php:L111, as referenced by Wordfence's disclosure.

RemediationAI

An upstream fix has been committed to the plugin's Subversion repository (changeset 3590578 at https://plugins.trac.wordpress.org/changeset?reponame=&old=3590578%40woocommerce-pdf-invoices-packing-slips&new=3590578%40woocommerce-pdf-invoices-packing-slips); however, the specific released patched version number is not confirmed in the available data - site administrators should update to the latest available version via the WordPress plugin dashboard and verify the installed version exceeds 5.14.0 once a new release is published. As an immediate compensating control, administrators should navigate to the plugin's settings and confirm or change 'Document link access type' to 'logged_in' (the default); this eliminates the exploit path entirely because generated URLs become nonce-signed and session-bound, preventing unauthenticated or third-party access. Disabling the 'full' access mode has the operational trade-off of requiring customers to be logged in to access document links - any existing 'full'-mode links distributed to customers will cease to function without session authentication. Additionally, review WordPress contributor-level role assignments to limit which accounts can invoke the generate_document_shortcode. The Wordfence advisory should be monitored for a confirmed patched version number.