WooCommerce PDF Invoices Plugin CVE-2026-49056

No special conditions - remote unauthenticated exploitation against default configurations of the WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels plugin at version 4.9.4 or earlier, reachable over HTTP(S) on a WordPress site with WooCommerce installed and the plugin activated. Exploitation is limited to confidentiality impact (C:H, I:N, A:N): the attacker can read sensitive invoice/order data but cannot modify orders or affect site availability through this issue, and the value of exploitation depends on the target actually having generated invoices/customer orders to disclose.

The CVSS 7.5 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:N/A:N) indicates a fully network-reachable, low-complexity, unauthenticated path to high-confidentiality impact with no integrity or availability impact - a realistic profile for direct disclosure of stored invoice data. EPSS, KEV status, and SSVC values were not provided in the input, so probabilistic exploitation modeling is unavailable; however, WordPress-plugin information-disclosure issues are typically scanned for at scale by mass exploitation tooling shortly after Patchstack publication, so treat exposure as time-sensitive even without a confirmed POC. There is no public exploit identified at time of analysis and the vulnerability is not on CISA KEV, but the very large install base of WooCommerce invoicing plugins and the privacy-regulated nature of the data exposed (likely GDPR/CCPA-relevant PII) elevate practical priority above what raw scores suggest.

A remote, unauthenticated attacker enumerates or guesses predictable document or AJAX endpoints exposed by the plugin on a target WooCommerce site and issues HTTP GET requests that return generated invoice PDFs or raw order data containing customer PII and order details. Because CVSS reports AV:N/AC:L/PR:N/UI:N, this can be scripted to scrape thousands of orders across many shops with no user interaction; no public exploit is identified at time of analysis, but the simplicity of the access pattern makes mass scanning likely once advisory details circulate.