Executive brief
The WebToffee WooCommerce PDF Invoices plugin, used by online stores to generate invoices and shipping labels, contains a directory traversal vulnerability that allows authenticated users with basic subscriber permissions to read sensitive files from the server. An attacker could access configuration files, database credentials, or other private data and extract them encoded in cached invoice documents, potentially leading to further compromise of the e-commerce platform and customer data.
Technical details
The vulnerability is a directory traversal flaw in the get_image_src_in_base64 function within the plugin's customizer component. Authenticated attackers with subscriber-level access or above can manipulate file paths to read arbitrary files from the server; the contents are then base64-encoded and embedded into cached invoice HTML. The files are subsequently accessible via the plugin's Print/Download invoice endpoints, which require only a valid nonce and access key. No additional network-level authentication or user interaction is needed beyond initial subscriber-level access. Patches are available in versions after 4.9.8.
Affected products
- WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels up to and including 4.9.8
Timeline
- 2026-08-23: disclosed
References
- https://plugins.trac.wordpress.org/browser/print-invoices-packing-slip-labels-for-woocommerce/tags/4.9.8/admin/modules/customizer/classes/class-customizer.php
- https://plugins.trac.wordpress.org/browser/print-invoices-packing-slip-labels-for-woocommerce/tags/4.9.8/admin/modules/customizer/customizer.php