{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-109217","assignerOrgId":"b15e7b5b-3da4-40ae-a43c-f7aa60e62599","state":"PUBLISHED","assignerShortName":"Wordfence","dateReserved":"2026-10-12T13:39:37.950Z","datePublished":"2026-10-31T06:44:22.823Z","dateUpdated":"2026-10-31T06:44:22.823Z"},"containers":{"cna":{"providerMetadata":{"orgId":"b15e7b5b-3da4-40ae-a43c-f7aa60e62599","shortName":"Wordfence","dateUpdated":"2026-10-31T06:44:22.823Z"},"affected":[{"vendor":"wpovernight","product":"PDF Invoices & Packing Slips for WooCommerce","versions":[{"version":"0","status":"affected","lessThanOrEqual":"5.16.5","versionType":"semver"}],"defaultStatus":"unaffected"}],"descriptions":[{"lang":"en","value":"The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.16.5 via the 'invoice_number (via document filename)' parameter. This makes it possible for unauthenticated attackers to extract another customer's complete invoice PDF — including billing identity, shipping address, private order notes, line items, prices, dates, order ID, and invoice number — delivered directly to the attacker's email as an order confirmation attachment. Exploitation requires the plugin's yearly invoice number reset option to be enabled, and the attacker's guest-checkout order must trigger a processing email within 60 seconds of a victim order that shares the same yearly-reset invoice number."}],"title":"PDF Invoices & Packing Slips for WooCommerce <= 5.16.5 - Unauthenticated Sensitive Information Exposure via Yearly-Reset Invoice Attachment Cache","references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e68495ad-53ab-4c6b-aecc-1e4bfe34aa0d?source=cve"},{"url":"https://plugins.trac.wordpress.org/browser/woocommerce-pdf-invoices-packing-slips/tags/5.16.4/includes/Main.php#L253"},{"url":"https://plugins.trac.wordpress.org/browser/woocommerce-pdf-invoices-packing-slips/tags/5.16.4/includes/Main.php#L239"},{"url":"https://plugins.trac.wordpress.org/browser/woocommerce-pdf-invoices-packing-slips/tags/5.16.4/includes/Documents/Invoice.php#L146"},{"url":"https://plugins.trac.wordpress.org/browser/woocommerce-pdf-invoices-packing-slips/tags/5.16.4/includes/Main.php#L181"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3759839%40woocommerce-pdf-invoices-packing-slips&new=3759839%40woocommerce-pdf-invoices-packing-slips"}],"problemTypes":[{"descriptions":[{"lang":"en","description":"CWE-524 Use of Cache Containing Sensitive Information","cweId":"CWE-524","type":"CWE"}]}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":5.3,"baseSeverity":"MEDIUM"}}],"credits":[{"lang":"en","type":"finder","value":"Santh"}],"timeline":[{"time":"2026-10-12T13:55:27.000Z","lang":"en","value":"Vendor Notified"},{"time":"2026-10-30T18:26:18.000Z","lang":"en","value":"Disclosed"}]}}}