WebToffee WooCommerce PDF Invoices EUVD-2026-96289

Requires the site to be configured to allow guest access to documents (the plugin setting 'wt_pklist_print_button_access_for' must NOT equal 'logged_in'); on default/logged-in-only configurations the guest handler is not exposed. The attacker must also know the specific target order ID and that order's associated billing email address, which the plugin treats as the (base64-encoded 'email') authorization token instead of the secret WooCommerce order_key. Limiting factors: exploitation is per-victim (one order at a time, no bulk dump implied), needs the non-default guest-access mode, and depends on knowing/guessing the billing email - a non-secret but not always readily available identifier. Affects plugin versions up to and including 5.0.2; fixed in 5.0.3.

This is a CWE-639 Insecure Direct Object Reference assigned CVSS 7.5 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, meaning network-reachable, low-complexity, unauthenticated access with high confidentiality impact and no integrity or availability impact - consistent with a pure data-disclosure (PII) bug rather than code execution or takeover. No EPSS score, CISA KEV listing, or public POC was provided in the input, so by precision rules this is 'no public exploit identified at time of analysis'; the signals therefore do not indicate active mass exploitation. The one point of friction the raw CVSS PR:N understates is that exploitation is gated on a non-default setting (wt_pklist_print_button_access_for != 'logged_in') AND on the attacker already knowing both the target order ID and the associated billing email, which the vendor characterizes as a non-secret identifier. Net: a legitimate confidentiality/privacy issue worth prioritizing on sites that enabled guest document access, but closer to a targeted PII-harvesting bug than a wormable critical - treat as a real but conditional priority, not a high-CVSS-but-trivial issue. No conflicting signals in the data; the main caveat is that CVSS PR:N does not reflect the required configuration precondition.

On a WooCommerce store running this plugin with guest document access enabled, an unauthenticated attacker who knows (or enumerates) a customer's order ID and billing email requests the guest print_document_from_the_mail_link handler with a base64-encoded 'email' matching the order's billing email. The handler authorizes on that non-secret email instead of the secret WooCommerce order_key, returning the victim's invoice/packing slip/label with full name, billing and shipping address, phone, purchased items, and prices. No public exploit code was identified at time of analysis, and the attack is network-based with low complexity but requires the non-default guest-access configuration.