Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-11496

PDF Builder for WooCommerce. Create invoices,packing slips and… · information disclosure

CVSS 3.1 6.5 MEDIUMCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-11496

Published

The Woo PDF Invoice Builder plugin (also distributed as "PDF Builder for WooCommerce") for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.8. This is due to the InspectOrder() AJAX handler (woocommerce-pdf-invoice-ajax.php:513), registered on wp_ajax_rednao_wcpdfinv_inspect_order, performing no capability check and no nonce verification before loading an arbitrary order by the attacker-supplied 'OrderNumber' POST field and serializing its full WC_Order::get_data() and meta to the response. This makes it possible for authenticated attackers with Subscriber-level access and above to read every WooCommerce order on the site — including billing/shipping address, email, phone number, payment method, gateway transaction ID, and order totals — by iterating order IDs.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-11496

Published

PDF Builder for WooCommerce. Create invoices,packing slips and more

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "edgarrojas",
                    "product": "PDF Builder for WooCommerce. Create invoices,packing slips and more",
                    "versions": [
                        {
                            "version": "0",
                            "status": "affected",
                            "lessThanOrEqual": "2.0.8",
                            "versionType": "semver"
                        }
                    ],
                    "defaultStatus": "unaffected"
                }

Original source record · Cite this exact observation · Complete original publisher JSON