Is CVE-2026-18027 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-18027 being exploited in the wild.

How severe is CVE-2026-18027?

Medium severity, with a CVSS score of 6.5, published 23 August 2026.

Which products and versions are affected?

WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels up to and including 4.9.8.

Is there a fix for CVE-2026-18027?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-18027 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-18027?

Check whether you run WebToffee WooCommerce PDF Invoices, Packing Slips or Delivery Notes & Shipping Labels at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-18027: WebToffee WooCommerce PDF Invoices directory traversal

CVE-2026-18027 · Severity: medium · CVSS 6.5 · Published 2026-08-23

The WebToffee WooCommerce PDF Invoices plugin, used by online stores to generate invoices and shipping labels, contains a directory traversal vulnerability that allows authenticated users with basic subscriber permissions to read sensitive files from the server. An attacker could access configuration files, database credentials, or other private data and extract them encoded in cached invoice documents, potentially leading to further compromise of the e-commerce platform and customer data.

Vendors: WebToffee.

Quick answers

Is CVE-2026-18027 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-18027 being exploited in the wild.
How severe is CVE-2026-18027?: Medium severity, with a CVSS score of 6.5, published 23 August 2026.
Which products and versions are affected?: WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels up to and including 4.9.8.
Is there a fix for CVE-2026-18027?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-18027 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-18027?: Check whether you run WebToffee WooCommerce PDF Invoices, Packing Slips or Delivery Notes & Shipping Labels at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a directory traversal flaw in the get_image_src_in_base64 function within the plugin's customizer component. Authenticated attackers with subscriber-level access or above can manipulate file paths to read arbitrary files from the server; the contents are then base64-encoded and embedded into cached invoice HTML. The files are subsequently accessible via the plugin's Print/Download invoice endpoints, which require only a valid nonce and access key. No additional network-level authentication or user interaction is needed beyond initial subscriber-level access. Patches are available in versions after 4.9.8.

Affected products

WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels up to and including 4.9.8

Timeline

2026-08-23: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.