# CVE-2026-93746: WebToffee WooCommerce PDF Invoices insecure direct object reference

Source: https://junglewise.ai/threats/cve-2026-93746-the-webtoffee-woocommerce-pdf-invoices-packing-slips-delivery  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-10. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-93746 · Severity: high · CVSS 7.5 · Published 2026-10-10

The WebToffee PDF Invoices plugin for WooCommerce e-commerce stores allows unauthenticated attackers to view any customer's invoices, packing slips, and shipping labels by knowing the order ID and billing email address. This exposes sensitive customer information including names, addresses, phone numbers, and purchase details without requiring authentication. The vulnerability affects plugin versions up to 5.0.2 when guest access to documents is enabled, putting customer data at risk.

Vendors: [WebToffee](https://junglewise.ai/threats/vendors/webtoffee).

## Quick answers

**Is CVE-2026-93746 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-93746 being exploited in the wild.

**How severe is CVE-2026-93746?** High severity, with a CVSS score of 7.5, published 10 October 2026.

**Which products and versions are affected?** WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels up to and including 5.0.2.

**Is there a fix for CVE-2026-93746?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-93746 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-93746?** Check whether you run WebToffee WooCommerce PDF Invoices, Packing Slips or Delivery Notes & Shipping Labels at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An insecure direct object reference (IDOR) flaw in the print_document_from_the_mail_link handler allows unauthenticated access to order documents when the attacker-supplied base64-encoded 'email' parameter matches the order's billing email address, which is not a secret identifier. The vulnerability requires guest document access to be enabled, and an attacker needs only the target order ID and billing email to retrieve sensitive order documentation including invoices, packing slips, delivery notes, and shipping labels.

## Affected products

- WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels up to and including 5.0.2

## Timeline

- 2026-10-10: disclosed

## References

- [https://plugins.trac.wordpress.org/browser/print-invoices-packing-slip-labels-for-woocommerce/tags/5.0.1/admin/class-wf-woocommerce-packing-list-admin.php](https://plugins.trac.wordpress.org/browser/print-invoices-packing-slip-labels-for-woocommerce/tags/5.0.1/admin/class-wf-woocommerce-packing-list-admin.php)
- [https://plugins.trac.wordpress.org/browser/print-invoices-packing-slip-labels-for-woocommerce/tags/5.0.1/admin/class-wf-woocommerce-packing-list-admin.php](https://plugins.trac.wordpress.org/browser/print-invoices-packing-slip-labels-for-woocommerce/tags/5.0.1/admin/class-wf-woocommerce-packing-list-admin.php)

## Related threats

- [WebToffee WooCommerce PDF Invoices directory traversal](https://junglewise.ai/threats/cve-2026-18027-webtoffee-woocommerce-pdf-invoices-directory-traversal)