Is CVE-2026-49056 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-49056 being exploited in the wild.

How severe is CVE-2026-49056?

High severity, with a CVSS score of 7.5, published 15 June 2026.

Is there a fix for CVE-2026-49056?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-49056 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-49056?

Check whether you run WebToffee PDF Invoices, Packing Slips or Delivery Notes and Shipping Labels for WooCommerce at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-49056: WebToffee WooCommerce PDF Invoices sensitive data exposure

CVE-2026-49056 · Severity: high · CVSS 7.5 · Published 2026-06-15

A vulnerability in a popular WordPress plugin used for generating e-commerce documents allows unauthorized individuals to access sensitive information. This plugin is typically used to create invoices, packing slips, and shipping labels for online stores. An attacker could exploit this flaw to view private customer or order data, potentially leading to privacy violations and further targeted attacks against the business or its customers.

Vendors: WebToffee.

Quick answers

Is CVE-2026-49056 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-49056 being exploited in the wild.
How severe is CVE-2026-49056?: High severity, with a CVSS score of 7.5, published 15 June 2026.
Which products and versions are affected?: WebToffee PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels for WooCommerce <= 4.9.4.
Is there a fix for CVE-2026-49056?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-49056 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-49056?: Check whether you run WebToffee PDF Invoices, Packing Slips or Delivery Notes and Shipping Labels for WooCommerce at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels plugin for WordPress is vulnerable to unauthenticated sensitive data exposure (CWE-497) in versions up to and including 4.9.4. The flaw allows a remote attacker to access sensitive system or transaction information without requiring any prior authentication or user interaction. This is likely due to insufficient access controls on generated documents or plugin-specific endpoints. An attacker can leverage this to harvest data that should be restricted to site administrators or specific customers. The issue is resolved in version 4.9.5.

Affected products

WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels <= 4.9.4

Timeline

2026-04-27: other: Vulnerability reported by Jakub Herman
2026-06-03: disclosed: Initial disclosure by Patchstack
2026-06-15: advisory: NVD publication date

References

https://patchstack.com/database/wordpress/plugin/print-invoices-packing-slip-labels-for-woocommerce/vulnerability/wordpress-woocommerce-pdf-invoices-packing-slips-delivery-notes-and-shipping-labels-plugin-4-9-4-sensitive-data-exposure-vulnerability?_s_id=cve

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.