WooCommerce PDF Invoices & Packing Slips <=5.14.0 IDOR Sensitive Information Disclosure CVE-2026-13116

Vulnerability Overview Vulnerability Name: PDF Invoices & Packing Slips for WooCommerce <= 5.14.0 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Disclosure via 'order_id' Shortcode Attribute CVE ID: CVE-2026-13116 CVSS Score: 4.3 (Medium) Publish Date: July 10, 2026 Last Updated: July 11, 2026 Researcher: Dmitri Ignatyev - CleanTalk Inc Affected Scope Software Type: Plugin Software Slug: woocommerce-pdf-invoices-packing-slips Affected Versions: <= 5.14.0 Fixed Version: 5.15.0 Remediation Recommendation: Update to version 5.15.0 or later Vulnerability Description This vulnerability allows an authenticated attacker (with Contributor level or higher) to access sensitive information from arbitrary third-party orders by exploiting the shortcode attribute within . This includes customer name, billing and shipping addresses, email address, phone number, order and invoice numbers, line items, totals, payment details, as well as invoices and packing slips included in those orders. References plugins.trac.wordpress.org Additional Information Authorization Bypass via User-Controllable Key: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:N Recent Vulnerabilities Multiple related vulnerabilities have been listed, including vulnerabilities in different versions of the PDF Invoices & Packing Slips for WooCommerce plugin involving PHP object injection, missing authorization, and unvalidated server-side request forgery (SSRF). Summary This vulnerability primarily affects older versions of the PDF Invoices & Packing Slips for WooCommerce plugin. Users are advised to update to version 5.15.0 or later as soon as possible to mitigate this security issue.

Goal Reached Thanks to every supporter — we hit 100%!

WooCommerce PDF Invoices & Packing Slips <=5.14.0 IDOR Sensitive Information Disclosure CVE-2026-13116

More from this source