Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-109217— PDF Invoices & Packing Slips for WooCommerce <= 5.16.5 - Unauthenticated Sensitive Information Exposure via Yearly-Reset Invoice Attachment Cache

Quick assessment

Affected
wpovernight PDF Invoices & Packing Slips for WooCommerce
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WordPress 的"PDF Invoices & Packing Slips for WooCommerce"插件在所有 5.16.5 及更早版本中存在敏感信息泄露漏洞，攻击面位于 参数（通过文档文件名传递）。该漏洞允许未认证的攻击者提取其他客户的完整发票 PDF 文件，内容包括：账单身份信息、收货地址、私人订单备注、商品明细、价格、日期、订单 ID 以及发票编号。攻击者可通过接收以“订单确认附件”形式直接发送至其邮箱的 PDF 文件获取上述信息。 成功利用该漏洞需满足以下条件： 1. 插件的“年度发票编号重置

CVSS 5.3 · Medium

Possible ATT&CK Techniques 1 AI

T1039 · Data from Network Shared Drive
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-109217

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
PDF Invoices & Packing Slips for WooCommerce <= 5.16.5 - Unauthenticated Sensitive Information Exposure via Yearly-Reset Invoice Attachment Cache
Source: CVE Program / CVE List V5
Vulnerability Description
The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.16.5 via the 'invoice_number (via document filename)' parameter. This makes it possible for unauthenticated attackers to extract another customer's complete invoice PDF — including billing identity, shipping address, private order notes, line items, prices, dates, order ID, and invoice number — delivered directly to the attacker's email as an order confirmation attachment. Exploitation requires the plugin's yearly invoice number reset option to be enabled, and the attacker's guest-checkout order must trigger a processing email within 60 seconds of a victim order that shares the same yearly-reset invoice number.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
通过缓存导致的信息暴露
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
wpovernight PDF Invoices & Packing Slips for WooCommerce 0 ~ 5.16.5 -

II. Public POCs for CVE-2026-109217

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-109217

请登录查看更多情报信息。

Other References for CVE-2026-109217 (6)

IV. Related Vulnerabilities

Same product: PDF Invoices & Packing Slips for WooCommerce
Same vendor: wpovernight
Same weakness: CWE-524