{"id":"CVE-2026-111593","kind":"vulnerability","aliases":["CVE-2026-111593"],"related":[],"title":"PDF Invoices for WooCommerce: rejected CVE, not a vulnerability","description":"Rejected reason: This CVE ID was reserved for a reported issue in the PDF Invoices & Packing Slips for WooCommerce WordPress plugin and was never published. On validation the reported behaviour was determined not to be a vulnerability: the Shop Manager role that could invoke the bulk invoice deletion and renumbering tool already holds the equivalent capability through the plugin's normal per-order invoice controls and through WooCommerce order management, so it crosses no privilege boundary. No CVE record should reference this ID.","summary":"This CVE ID was reserved for a reported issue in the PDF Invoices & Packing Slips for WooCommerce plugin but was rejected and never published. Validation found the Shop Manager role already holds equivalent invoice deletion and renumbering capability, so no privilege boundary is crossed.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["other","woocommerce","wordpress"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"withdrawn","published_at":"2026-10-16T14:17:23+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-25T05:27:43+00:00","updated_at":"2026-10-25T05:27:43+00:00","category":"other","confidence":0.9,"triage":{"at":"2026-10-25T05:27:43Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"PDF Invoices for WooCommerce: rejected CVE, not a vulnerability","impact":"low","summary":"This CVE ID was reserved for a reported issue in the PDF Invoices & Packing Slips for WooCommerce plugin but was rejected and never published. Validation found the Shop Manager role already holds equivalent invoice deletion and renumbering capability, so no privilege boundary is crossed.","category":"other","nicknames":[],"who_cares":["woocommerce","wordpress"],"confidence":0.9,"needs_auth":"unknown","worst_case":"unknown","analyst_note":"","how_to_check":"unknown","needs_analyst":false,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000496,"input_tokens":3396,"output_tokens":312,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-111593':12A,15A '-2026':11A,14A 'alreadi':49B,114C 'behaviour':92C 'boundari':60B,139C 'bulk':108C 'capabl':56B,118C 'control':128C 'could':105C 'cross':62B,136C 'cve':6A,10A,13A,20B,66C,141C 'delet':53B,110C 'determin':94C 'equival':51B,117C 'found':44B 'hold':50B,115C 'id':21B,67C,146C 'invoic':2A,31B,52B,77C,109C,127C 'invok':106C 'issu':27B,73C 'manag':47B,102C,133C 'never':41B,86C 'normal':123C 'order':126C,132C 'pack':32B,78C 'pdf':1A,30B,76C 'per':125C 'per-ord':124C 'plugin':36B,83C,121C 'privileg':59B,138C 'publish':42B,87C 'reason':64C 'record':142C 'refer':144C 'reject':5A,39B,63C 'renumb':55B,112C 'report':26B,72C,91C 'reserv':23B,69C 'role':48B,103C 'shop':46B,101C 'slip':33B,79C 'tool':113C 'valid':43B,89C 'vulner':9A,99C 'woocommerc':4A,17B,35B,81C,131C 'wordpress':18B,82C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T14:17:23+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111593","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111593","severity":null,"published_at":"2026-10-16T14:17:23+00:00","modified_at":"2026-10-16T23:10:00+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}