WebToffee WooCommerce Plugin <= 4.9.8 Authenticated Arbitrary File Read via customer_note (CVE-2026-18027)

Vulnerability Overview Vulnerability Name: WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels <= 4.9.8 - Authenticated (Subscriber+) Arbitrary File Read via 'customer_note' Parameter CVE ID: CVE-2026-18027 CVSS Score: 6.5 (Medium) Release Date: August 22, 2026 Last Updated: August 22, 2026 Researcher: daroo Impact Scope Software Type: Plugin Software Name: print-invoices-packing-slip-labels-for-woocommerce Affected Versions: <= 4.9.8 Patched Version: 5.0.0 Remediation Fix Method: Upgrade to version 5.0.0 or later patched versions Vulnerability Description This vulnerability allows authenticated attackers (at the Subscriber level and above) to read arbitrary files from the server via the parameter. Attackers can exploit this vulnerability to read sensitive information, such as configuration files, log files, etc. References plugins.trac.wordpress.org plugins.trac.wordpress.org plugins.trac.wordpress.org plugins.trac.wordpress.org Additional Information Sharing Options: This vulnerability information can be shared via Facebook, Twitter, LinkedIn, and Email. Recent Vulnerabilities Recent Vulnerability List: 1. WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels <= 4.9.4 - Unauthenticated Information Exposure 2. WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels <= 4.7.1 - Authenticated (Shop Manager+) Stored Cross-Site Scripting 3. WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels <= 4.4.2 - Missing Authorization to Unauthenticated Settings Reset 4. WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels <= 4.4.0 - Reflected Cross-Site Scripting 5. WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels <= 4.4.1 - Unauthenticated Stored Cross-Site Scripting 6. WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels <= 4.3.0 - Missing Authorization to Order Export 7. WooCommerce PDF Invoices <= 4.2.1 - Authenticated (Shop Manager+) Arbitrary Options Update via JSON Import Copyright Information Copyright: © 2012-2026 Defiant Inc. All Rights Reserved. Contact Information Technical Support: 24/7 support, 365 days a year, with a 1-hour response time. Business Hours: 9 AM - 8 PM ET, 6 AM - 5 PM PT, and 2 PM - 1 AM UTC/GMT (excluding weekends and holidays). Other Links Terms of Service: Link Privacy Policy and Notice at Collection: Link Do Not Sell or Share My Personal Information: Link Social Media Facebook: Link Twitter: Link LinkedIn: Link Instagram: Link Subscription Subscription Link: Link Disclaimer Disclaimer: The content on this page is for reference only and does not constitute any legal advice. Users should assess risks and take appropriate measures on their own. Summary This vulnerability involves an arbitrary file read issue in the WebToffee WooCommerce PDF Invoices plugin, affecting versions 4.9.8 and below. Users are advised to upgrade to version 5.0.0 or higher as soon as possible to patch this vulnerability.

Goal Reached Thanks to every supporter — we hit 100%!

WebToffee WooCommerce Plugin <= 4.9.8 Authenticated Arbitrary File Read via customer_note (CVE-2026-18027)