CVE-2026-109217 Details

A vulnerability allowing sensitive information exposure has been identified in the PDF Invoices & Packing Slips for WooCommerce plugin, affecting all versions through 5.16.5. The issue arises from the 'invoice_number' parameter, which can be exploited by unauthenticated attackers to access and extract complete invoice PDFs of other customers. These PDFs include detailed information such as billing identity, shipping address, private order notes, line items, prices, dates, order ID, and invoice number. The extracted invoice is sent directly to the attacker's email as an order confirmation attachment. Exploitation of this vulnerability requires the plugin's yearly invoice number reset option to be enabled. Additionally, the attacker's guest-checkout order must trigger a processing email within 60 seconds of a victim's order that shares the same yearly-reset invoice number.

Users are advised to update the PDF Invoices & Packing Slips for WooCommerce plugin to version 5.16.6 or a newer patched version.