# CVE-2026-49056: WebToffee WooCommerce PDF Invoices sensitive data exposure

Source: https://junglewise.ai/threats/cve-2026-49056-webtoffee-woocommerce-pdf-invoices-sensitive-data-exposure  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-15. Updated: 2026-06-15  
License: CC BY 4.0 with a link back

CVE-2026-49056 · Severity: high · CVSS 7.5 · Published 2026-06-15

A vulnerability in a popular WordPress plugin used for generating e-commerce documents allows unauthorized individuals to access sensitive information. This plugin is typically used to create invoices, packing slips, and shipping labels for online stores. An attacker could exploit this flaw to view private customer or order data, potentially leading to privacy violations and further targeted attacks against the business or its customers.

Vendors: [WebToffee](https://junglewise.ai/threats/vendors/webtoffee).

## Quick answers

**Is CVE-2026-49056 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-49056 being exploited in the wild.

**How severe is CVE-2026-49056?** High severity, with a CVSS score of 7.5, published 15 June 2026.

**Which products and versions are affected?** WebToffee PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels for WooCommerce <= 4.9.4.

**Is there a fix for CVE-2026-49056?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-49056 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-49056?** Check whether you run WebToffee PDF Invoices, Packing Slips or Delivery Notes and Shipping Labels for WooCommerce at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels plugin for WordPress is vulnerable to unauthenticated sensitive data exposure (CWE-497) in versions up to and including 4.9.4. The flaw allows a remote attacker to access sensitive system or transaction information without requiring any prior authentication or user interaction. This is likely due to insufficient access controls on generated documents or plugin-specific endpoints. An attacker can leverage this to harvest data that should be restricted to site administrators or specific customers. The issue is resolved in version 4.9.5.

## Affected products

- WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels <= 4.9.4

## Timeline

- 2026-04-27: other: Vulnerability reported by Jakub Herman
- 2026-06-03: disclosed: Initial disclosure by Patchstack
- 2026-06-15: advisory: NVD publication date

## References

- [https://patchstack.com/database/wordpress/plugin/print-invoices-packing-slip-labels-for-woocommerce/vulnerability/wordpress-woocommerce-pdf-invoices-packing-slips-delivery-notes-and-shipping-labels-plugin-4-9-4-sensitive-data-exposure-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/print-invoices-packing-slip-labels-for-woocommerce/vulnerability/wordpress-woocommerce-pdf-invoices-packing-slips-delivery-notes-and-shipping-labels-plugin-4-9-4-sensitive-data-exposure-vulnerability?_s_id=cve)