WooCommerce PDF Invoices EUVD-2026-43138

Two conditions must both be true for exploitation to be possible. First, the attacker must hold a WordPress account at contributor level or higher on the target site - unauthenticated visitors cannot invoke the shortcode. Second, the plugin's 'Document link access type' setting must be explicitly configured to 'full'; with the default 'logged_in' value, the shortcode signs generated URLs with a per-session nonce tied to the generating user, meaning links produced by one user cannot be used by another and do not expose third-party order data. What limits exploitation: the non-default configuration requirement significantly restricts the vulnerable population to stores whose administrators have deliberately changed this setting; contributor-level access is required and cannot be obtained anonymously; and the attack targets confidentiality only, with no integrity or availability impact.

The NVD-assigned CVSS 3.1 score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) accurately reflects the attack surface: network-reachable, low complexity once in position, but requiring at minimum contributor-level WordPress authentication and - critically - a non-default plugin configuration. The 'Document link access type: full' setting is the decisive gate; the default 'logged_in' configuration uses per-session nonce signing that prevents unauthorized access to third-party orders entirely. This configuration dependency materially lowers real-world risk below what the CVSS vector alone implies: most WordPress sites using this plugin are likely running the default setting, making the vulnerable code path inactive for the majority of deployments. EPSS data was not provided in the input; without it, exploitation probability cannot be quantified. The vulnerability is not listed in CISA KEV, and no public exploit or POC has been identified. Despite the relatively low numeric score, the potential confidentiality impact on affected stores is significant from a privacy and regulatory (GDPR, PCI-DSS) standpoint, since exposed data includes payment and identity details of third-party customers. Real-world priority is medium-low for default configurations and medium-high for any store that has explicitly enabled 'full' document link access.

An attacker with a contributor-level WordPress account on a store where the plugin's link access type is set to 'full' uses the generate_document_shortcode with an incremented or enumerated order ID belonging to another customer. The shortcode generates a permanent, session-free URL to that order's invoice PDF, which the attacker can then access directly from any browser without authentication, retrieving the victim customer's name, address, email, phone number, order totals, and payment details.