{"id":"CVE-2026-93746","revision":"45cecb44e29a42f7980088bf68f5a90f","records":[{"revision":"45cecb44e29a42f7980088bf68f5a90f","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-93746","aliases":[],"title":"WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels <= 5.0.2 - Insecure Direct Object Reference to Unauthenticated Unauthorized Order Document Access via 'email' Parameter","description":"The WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.0.2 via the 'email' parameter of the guest print_document_from_the_mail_link handler dispatched from print_window() on init. This is due to the handler authorizing access to an order's printable documents when the attacker-supplied (base64-encoded) 'email' equals the order's billing email — a non-secret identifier — instead of requiring the WooCommerce order_key. This makes it possible for unauthenticated attackers, when the site is configured to allow guest access to documents ('wt_pklist_print_button_access_for' != 'logged_in'), to retrieve any other customer's invoice, packing slip, delivery note, dispatch label or shipping label — including customer name, billing/shipping address, phone number, purchased products, prices, taxes and invoice metadata — by knowing the target order ID and the associated billing email address.","state":0,"publishedAt":"2026-10-10T07:41:48.536+00:00","modifiedAt":"2026-10-11T16:55:15.249+00:00","affected":[{"ecosystem":"Vendor product","name":"WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"webtoffee\",\n                    \"product\": \"WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels\",\n                    \"versions\": [\n                        {\n                            \"version\": \"0\",\n                            \"status\": \"affected\",\n                            \"lessThanOrEqual\": \"5.0.2\",\n                            \"versionType\": \"semver\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\"\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","score":7.5,"severity":"HIGH"}],"references":["https://www.wordfence.com/threat-intel/vulnerabilities/id/cf5ccfe6-c0e3-412f-9a93-2ccabb9997e7?source=cve","https://plugins.trac.wordpress.org/browser/print-invoices-packing-slip-labels-for-woocommerce/tags/5.0.1/admin/class-wf-woocommerce-packing-list-admin.php#L1149","https://plugins.trac.wordpress.org/browser/print-invoices-packing-slip-labels-for-woocommerce/tags/5.0.1/admin/class-wf-woocommerce-packing-list-admin.php#L1128","https://plugins.trac.wordpress.org/browser/print-invoices-packing-slip-labels-for-woocommerce/tags/5.0.1/admin/class-wf-woocommerce-packing-list-admin.php#L1127","https://plugins.trac.wordpress.org/browser/print-invoices-packing-slip-labels-for-woocommerce/tags/5.0.1/admin/class-wf-woocommerce-packing-list-admin.php#L990","https://plugins.trac.wordpress.org/changeset?reponame=&new=3718644%40print-invoices-packing-slip-labels-for-woocommerce%2Ftags%2F5.0.3&old=3707093%40print-invoices-packing-slip-labels-for-woocommerce%2Ftags%2F5.0.2"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-93746","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-93746","identifiers":["CVE-2026-93746"]},"retained":false,"historicalAffected":[]}],"coverage":[]}