{"id":"CVE-2026-109217","kind":"vulnerability","aliases":["CVE-2026-109217"],"related":[],"title":"WooCommerce PDF Invoices plugin: unauthenticated users can extract other customers' invoices","description":"The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.16.5 via the 'invoice_number (via document filename)' parameter. This makes it possible for unauthenticated attackers to extract another customer's complete invoice PDF — including billing identity, shipping address, private order notes, line items, prices, dates, order ID, and invoice number — delivered directly to the attacker's email as an order confirmation attachment. Exploitation requires the plugin's yearly invoice number reset option to be enabled, and the attacker's guest-checkout order must trigger a processing email within 60 seconds of a victim order that shares the same yearly-reset invoice number.","summary":"The PDF Invoices & Packing Slips for WooCommerce WordPress plugin, up to and including 5.16.5, exposes another customer's full invoice PDF through the invoice number parameter. An unauthenticated attacker can receive a victim's billing identity, shipping address, order notes, line items and invoice number by email.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","pdf-invoices-packing-slips","woocommerce","wordpress"],"not_affected_if":["plugin-updated","yearly-reset-off"],"how_to_check":"- Check the installed version of PDF Invoices & Packing Slips for WooCommerce in the WordPress plugins list; versions up to and including `5.16.5` are affected.\n- Check whether the plugin's yearly invoice number reset option is enabled in its settings.","fix":"- Move the PDF Invoices & Packing Slips for WooCommerce plugin to a version later than `5.16.5`; the sources do not name the fixed version.","status":"open","published_at":"2026-10-31T07:16:34+00:00","first_seen_at":"2026-10-31T07:34:06+00:00","triaged_at":"2026-10-31T07:34:51+00:00","updated_at":"2026-10-31T07:34:51+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-31T07:34:51Z","model":"claude-haiku-5-5","output":{"fix":"- Move the PDF Invoices & Packing Slips for WooCommerce plugin to a version later than `5.16.5`; the sources do not name the fixed version.","reach":"internet","title":"WooCommerce PDF Invoices plugin: unauthenticated users can extract other customers' invoices","impact":"medium","summary":"The PDF Invoices & Packing Slips for WooCommerce WordPress plugin, up to and including 5.16.5, exposes another customer's full invoice PDF through the invoice number parameter. An unauthenticated attacker can receive a victim's billing identity, shipping address, order notes, line items and invoice number by email.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","pdf-invoices-packing-slips"],"confidence":0.8,"fix_status":"unknown","needs_auth":"no","worst_case":"another customer's invoice data is emailed to the attacker","analyst_note":"","how_to_check":"- Check the installed version of PDF Invoices & Packing Slips for WooCommerce in the WordPress plugins list; versions up to and including `5.16.5` are affected.\n- Check whether the plugin's yearly invoice number reset option is enabled in its settings.","plain_action":"","needs_analyst":false,"not_affected_if":["plugin-updated","yearly-reset-off"],"who_is_affected":"Stores running the PDF Invoices & Packing Slips for WooCommerce plugin up to version 5.16.5 with the yearly invoice number reset option enabled are exposed. The attack needs a guest-checkout order placed within 60 seconds of a victim order sharing the same yearly-reset invoice number. Stores with the plugin absent, updated, or with the yearly reset option off can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000755,"input_tokens":4285,"output_tokens":652,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-109217':14A,17A '-2026':13A,16A '5.16.5':39B,96C '60':176C 'address':63B,124C 'anoth':41B,114C 'attach':148C 'attack':54B,111C,141C,164C 'bill':60B,121C 'checkout':168C 'complet':117C 'confirm':147C 'custom':10A,42B,115C 'cve':12A,15A 'date':131C 'deliv':137C 'direct':138C 'document':102C 'email':72B,143C,174C 'enabl':161C 'exploit':149C 'expos':40B 'exposur':88C 'extract':8A,113C 'filenam':103C 'full':44B 'guest':167C 'guest-checkout':166C 'id':133C 'ident':61B,122C 'includ':38B,95C,120C 'inform':87C 'invoic':3A,11A,21B,28B,45B,49B,69B,75C,99C,118C,135C,155C,189C 'item':67B,129C 'line':66B,128C 'make':106C 'must':170C 'note':65B,127C 'number':50B,70B,100C,136C,156C,190C 'option':158C 'order':64B,126C,132C,146C,169C,181C 'pack':22B,29B,76C 'packag':18B 'paramet':51B,104C 'pdf':2A,20B,27B,46B,74C,119C 'pdf-invoices-packing-slip':19B 'plugin':4A,34B,80C,152C 'possibl':108C 'price':130C 'privat':125C 'process':173C 'receiv':56B 'requir':150C 'reset':157C,188C 'second':177C 'sensit':86C 'share':183C 'ship':62B,123C 'slip':23B,30B,77C 'trigger':171C 'unauthent':5A,53B,110C 'user':6A 'version':91C 'via':97C,101C 'victim':58B,180C 'vulner':84C 'within':175C 'woocommerc':1A,24B,32B,79C 'wordpress':25B,33B,82C 'year':154C,187C 'yearly-reset':186C","nicknames":[],"mitigations":[],"who_affected":"Stores running the PDF Invoices & Packing Slips for WooCommerce plugin up to version 5.16.5 with the yearly invoice number reset option enabled are exposed. The attack needs a guest-checkout order placed within 60 seconds of a victim order sharing the same yearly-reset invoice number. Stores with the plugin absent, updated, or with the yearly reset option off can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-31T07:16:34+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-109217","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109217","severity":null,"published_at":"2026-10-31T07:16:34+00:00","modified_at":"2026-10-31T07:16:34+00:00","first_seen_at":"2026-10-31T07:34:06+00:00","fetched_at":"2026-10-31T07:34:06+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}