Junglewise Threat Intelligence

CVE-2026-13116: WP Overnight PDF Invoices & Packing Slips for WooCommerce IDOR

CVE-2026-13116 · Severity: medium · CVSS 4.3 · Published 2026-07-11

Executive brief

A vulnerability in a popular WordPress e-commerce plugin allows users with low-level account access (such as contributors) to view sensitive customer information from other people's orders. This includes names, addresses, phone numbers, and payment details found on invoices and packing slips. The issue occurs when the plugin is configured to allow 'full' document link access, potentially leading to a significant data privacy breach.

Technical details

The vulnerability is an Insecure Direct Object Reference (IDOR) within the 'generate_document_shortcode' function due to missing validation on a user-controlled key. Authenticated attackers with contributor-level permissions or higher can exploit this to generate session-free download links for invoices and packing slips belonging to any customer. This exposure includes PII such as billing/shipping addresses, email addresses, and order totals. The vulnerability is only exploitable if the 'Document link access type' setting is set to 'full'; the default 'logged_in' setting uses per-session nonces which mitigates the risk. A fix is available in versions following 5.14.0.

Affected products

  • WP Overnight PDF Invoices & Packing Slips for WooCommerce <= 5.14.0

Timeline

  • 2026-07-11: disclosed
  • 2026-07-11: advisory

References