What is the CVSS score of CVE-2026-57393?

CVE-2026-57393 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

WooCommerce PDF Invoice Builder CVE-2026-57393

EUVD-2026-43467 MEDIUM

Exposure of Sensitive System Information to an Unauthorized Control Sphere (CWE-497)

2026-07-13 Patchstack

WordPress Information Disclosure Woocommerce Pdf Invoice Builder Wordpress Plugin

6.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Network-reachable plugin endpoint requires only a low-privilege account; no integrity or availability impact; high confidentiality loss aligns with CWE-497 sensitive data retrieval.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 11:27 vuln.today

CVE Published

Jul 13, 2026 - 08:41 cve.org

MEDIUM 6.5

DescriptionCVE.org

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in EDGARROJAS WooCommerce PDF Invoice Builder woo-pdf-invoice-builder allows Retrieve Embedded Sensitive Data.This issue affects WooCommerce PDF Invoice Builder: from n/a through <= 2.0.8.

AnalysisAI

Sensitive system information exposure in the WooCommerce PDF Invoice Builder WordPress plugin (versions through 2.0.8) enables authenticated low-privilege users to retrieve embedded sensitive data via network requests. Classified under CWE-497, the flaw allows an attacker with minimal WordPress credentials - such as a customer or subscriber account - to access system-level or configuration data that should be restricted to administrative contexts. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the high confidentiality impact and low privilege requirement make it a meaningful risk for WooCommerce merchants running affected plugin versions.

Technical ContextAI

The affected component is the WooCommerce PDF Invoice Builder plugin by EDGARROJAS (CPE: cpe:2.3:a:edgarrojas:woocommerce_pdf_invoice_builder:*:*:*:*:*:*:*:*), a WordPress plugin designed to generate PDF invoices for WooCommerce orders. CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere) describes a class of vulnerability where internal or system-level data - such as file paths, configuration values, environment variables, database credentials, or plugin internals - becomes accessible through application outputs, API responses, or generated documents that low-privilege users can request. In the context of a PDF invoice plugin, this commonly manifests as sensitive server-side data embedded into or leaked through invoice generation endpoints, REST API calls, or AJAX handlers that fail to enforce proper authorization checks. The CVSS vector AV:N/PR:L confirms the flaw is reachable over the network by any authenticated WordPress user.

RemediationAI

The primary remediation is to update the WooCommerce PDF Invoice Builder plugin beyond version 2.0.8; however, no specific patched release version was confirmed in the available intelligence data - users should check the WordPress plugin repository or the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/woo-pdf-invoice-builder/vulnerability/wordpress-woocommerce-pdf-invoice-builder-plugin-2-0-8-sensitive-data-exposure-vulnerability for the latest available fixed release. If no update is available or cannot be immediately applied, consider deactivating and removing the plugin as a compensating control, accepting that invoice generation functionality will be unavailable. As a secondary control, restricting WordPress user registration to trusted individuals reduces the pool of potential attackers, since exploitation requires a low-privilege authenticated account. Deploying a web application firewall (WAF) with WordPress-aware rules may detect and block anomalous requests to plugin endpoints, though this is not a substitute for patching. Store administrators should also audit which users hold subscriber or customer roles and review recent plugin-related access logs for anomalous retrieval patterns.