Executive brief
The PDF Builder for WooCommerce plugin, used to generate invoices and packing slips in online stores, fails to properly verify user permissions. An attacker with a basic subscriber account can retrieve invoice details (invoice numbers and creation dates) for any order in the store by bypassing security checks, potentially exposing sensitive business information.
Technical details
The plugin fails to properly validate authorization when processing invoice data retrieval requests, allowing authenticated subscribers to access arbitrary order invoice metadata by supplying order and invoice identifiers with an invalid nonce. This authorization bypass affects AJAX endpoints that handle invoice data without adequate permission checks, exposing invoice numbers and timestamps across all orders regardless of ownership.
Affected products
- WooThemes PDF Builder for WooCommerce up to 2.0.11
Timeline
- 2026-09-19: disclosed