Live › vulnerability › CVE-2026-109217
The PDF Invoices & Packing Slips for WooCommerce WordPress plugin, up to and including 5.16.5, exposes another customer's full invoice PDF through the invoice number parameter. An unauthenticated attacker can receive a victim's billing identity, shipping address, order notes, line items and invoice number by email.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-31 07:34 UTC. All times on this page are UTC.
Stores running the PDF Invoices & Packing Slips for WooCommerce plugin up to version 5.16.5 with the yearly invoice number reset option enabled are exposed. The attack needs a guest-checkout order placed within 60 seconds of a victim order sharing the same yearly-reset invoice number. Stores with the plugin absent, updated, or with the yearly reset option off can skip it.
No product ranges from the sources yet.
5.16.5 are affected.5.16.5; the sources do not name the fixed version.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.16.5 via the 'invoice_number (via document filename)' parameter. This makes it possible for unauthenticated attackers to extract another customer's complete invoice PDF — including billing identity, shipping address, private order notes, line items, prices, dates, order ID, and invoice number — delivered directly to the attacker's email as an order confirmation attachment. Exploitation requires the plugin's yearly invoice number reset option to be enabled, and the attacker's guest-checkout order must trigger a processing email within 60 seconds of a victim order that shares the same yearly-reset invoice number.
This page as .md · .json · in your agent: get_signal("CVE-2026-109217")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.