CVE-2026-13116Published

PDF Invoices & Packing Slips for WooCommerce <= 5.14.0 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Disclosure via 'order_id' Shortcode Attribute

Exact source revision recorded 30 Oct 2026 00:49:17 UTC. It does not establish the source's current position. Latest evidence.

Recorded JSON

cve-program · CVE-2026-13116

Published

PDF Invoices & Packing Slips for WooCommerce

Vendor product

Original vendor version evidence · not evaluated as a NuGet range

{
                    "vendor": "wpovernight",
                    "product": "PDF Invoices & Packing Slips for WooCommerce",
                    "versions": [
                        {
                            "version": "0",
                            "status": "affected",
                            "lessThanOrEqual": "5.14.0",
                            "versionType": "semver"
                        }
                    ],
                    "defaultStatus": "unaffected"
                }

Original source record · Cite this exact observation · Complete original publisher JSON