Webtoffee Woocommerce Pdf Invoices Packing Slips Delivery Notes Shipping Labels
Monthly
Unauthenticated attackers can retrieve any customer's invoice, packing slip, delivery note, dispatch label or shipping label from WordPress sites running the WebToffee WooCommerce PDF Invoices plugin up to and including 5.0.2, exposed via the guest 'print_document_from_the_mail_link' handler. The handler authenticates document access by comparing a base64-encoded 'email' parameter against the order's billing email - a non-secret identifier - rather than the secret WooCommerce order_key, so anyone who knows a target order ID and that order's billing email can pull the full document contents (name, billing/shipping address, phone, products, prices, taxes, invoice metadata). Exploitation requires the site to be configured with guest document access ('wt_pklist_print_button_access_for' != 'logged_in'), so default logged-in-only configurations are not exposed; risk is rated CVSS 7.5 with high confidentiality impact but no integrity or availability impact, and no public exploit code has been identified at time of analysis.
Unauthenticated attackers can retrieve any customer's invoice, packing slip, delivery note, dispatch label or shipping label from WordPress sites running the WebToffee WooCommerce PDF Invoices plugin up to and including 5.0.2, exposed via the guest 'print_document_from_the_mail_link' handler. The handler authenticates document access by comparing a base64-encoded 'email' parameter against the order's billing email - a non-secret identifier - rather than the secret WooCommerce order_key, so anyone who knows a target order ID and that order's billing email can pull the full document contents (name, billing/shipping address, phone, products, prices, taxes, invoice metadata). Exploitation requires the site to be configured with guest document access ('wt_pklist_print_button_access_for' != 'logged_in'), so default logged-in-only configurations are not exposed; risk is rated CVSS 7.5 with high confidentiality impact but no integrity or availability impact, and no public exploit code has been identified at time of analysis.