Junglewise Threat Intelligence

CVE-2026-11899: WordPress PDF Builder for WooCommerce authorization bypass

CVE-2026-11899 · Severity: medium · CVSS 4.3 · Published 2026-09-19

Executive brief

The PDF Builder for WooCommerce plugin, used to generate invoices and packing slips in online stores, fails to properly verify user permissions. An attacker with a basic subscriber account can retrieve invoice details (invoice numbers and creation dates) for any order in the store by bypassing security checks, potentially exposing sensitive business information.

Technical details

The plugin fails to properly validate authorization when processing invoice data retrieval requests, allowing authenticated subscribers to access arbitrary order invoice metadata by supplying order and invoice identifiers with an invalid nonce. This authorization bypass affects AJAX endpoints that handle invoice data without adequate permission checks, exposing invoice numbers and timestamps across all orders regardless of ownership.

Affected products

  • WooThemes PDF Builder for WooCommerce up to 2.0.11

Timeline

  • 2026-09-19: disclosed

References