Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-93746— WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels <= 5.0.2 - Insecure Direct Object Reference to Unauthenticated Unauthorized Order Document Access via 'email' Parameter

Quick assessment

Affected
webtoffee WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WordPress 插件 WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels 在 5.0.2 及以下版本中存在不安全的直接对象引用（Insecure Direct Object Reference）漏洞。该漏洞存在于通过 函数在 阶段调用的 处理程序中的 参数。 此漏洞的原因在于，该处理程序在攻击者提供的（base64 编码） 值等于订单的账单电子邮件地址时，即授权访问该订单的可打印文档。然而，账单电

CVSS 7.5 · High EPSS 0.53% · P43

Affected Version Matrix 1

VendorProduct Version RangeStatus
webtoffee WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels ≤ 5.0.2 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-93746

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels <= 5.0.2 - Insecure Direct Object Reference to Unauthenticated Unauthorized Order Document Access via 'email' Parameter
Source: CVE Program / CVE List V5
Vulnerability Description
The WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.0.2 via the 'email' parameter of the guest print_document_from_the_mail_link handler dispatched from print_window() on init. This is due to the handler authorizing access to an order's printable documents when the attacker-supplied (base64-encoded) 'email' equals the order's billing email — a non-secret identifier — instead of requiring the WooCommerce order_key. This makes it possible for unauthenticated attackers, when the site is configured to allow guest access to documents ('wt_pklist_print_button_access_for' != 'logged_in'), to retrieve any other customer's invoice, packing slip, delivery note, dispatch label or shipping label — including customer name, billing/shipping address, phone number, purchased products, prices, taxes and invoice metadata — by knowing the target order ID and the associated billing email address.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
通过用户控制密钥绕过授权机制
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
webtoffee WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels 0 ~ 5.0.2 -

II. Public POCs for CVE-2026-93746

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-93746

请登录查看更多情报信息。

IV. Related Vulnerabilities

Same product: WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels
Same vendor: webtoffee
Same weakness: CWE-639

V. Comments for CVE-2026-93746

No comments yet

Leave a comment