WooCommerce PDF Invoices & Packing Slips Plugin Sensitive Information Exposure (CVE-2026-109217)
Executive & SecOps Summary
SECOPS ASSESSMENTWooCommerce PDF Invoices & Packing Slips WordPress plugin up to and including version 5.16.5
Unauthenticated attackers can extract complete PDF invoices of other customers, including billing/shipping addresses, order notes, and pricing, delivered directly to the attacker's email
Immediately upgrade the plugin to version 5.16.6 or higher, and disable the yearly invoice number reset option as a temporary workaround
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
The primary remediation is upgrading the plugin to version 5.16.6 or later. This can be performed seamlessly via WP-CLI.
# Update the WooCommerce PDF Invoices plugin using WP-CLI
wp plugin update woocommerce-pdf-invoices-packing-slips --activate
# Verify that the installed version is secure (5.16.6 or higher)
wp plugin get woocommerce-pdf-invoices-packing-slips --field=version2. Temporary Workaround & Hardening Configuration
If an immediate update is not feasible, disable the 'yearly invoice number reset' option in the plugin settings. Additionally, restrict direct web access to the PDF generation and upload directories via your web server configuration.
# Nginx configuration to block direct access to the PDF invoice storage directory
location ~* /wp-content/uploads/wpo_wcpdf/ {
deny all;
return 403;
}3. Log Audit & IoC Verification Commands
Administrators should audit web server access logs for rapid, successive guest checkout requests occurring within short time windows (under 60 seconds).
# Scan access logs for potential exploitation attempts targeting the checkout endpoint
grep -E 'POST.*wc-ajax=checkout' /var/log/nginx/access.log | awk '{print $4}' | uniq -c | awk '$1 > 3 {print "[ALERT] High-frequency checkout activity detected: " $0}'Block Exploits Instantly with Managed Virtual Patching Rules
Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
The 'PDF Invoices & Packing Slips for WooCommerce' plugin for WordPress is vulnerable to Sensitive Information Exposure (CWE-524) via the 'invoice_number' parameter used in document filenames. The root cause lies in insufficient uniqueness in filename generation when the plugin's 'yearly invoice number reset' option is enabled. This configuration allows multiple orders across different years or contexts to share identical invoice numbers, leading to filename collisions and cross-session data leakage.
2. Exploitation Mechanics & Attack Scenario
The attack is executed by an unauthenticated user utilizing the guest-checkout functionality:
- The attacker places a guest order on the target WooCommerce store.
- A legitimate victim places an order around the same time, generating an invoice with a matching yearly-reset invoice number.
- If the attacker's guest-checkout order triggers a processing email within 60 seconds of the victim's order, the system misidentifies the target PDF file due to the filename collision.
- Consequently, the victim's complete PDF invoice—containing sensitive PII—is attached to the order confirmation email sent directly to the attacker.
3. Infrastructure & Business Impact
This vulnerability poses a severe threat to data privacy and compliance (such as GDPR, CCPA, and local privacy regulations). Exposed data includes full names, physical addresses, phone numbers, and purchasing histories. Exploitation can lead to massive data harvesting, loss of customer trust, potential legal penalties, and competitive intelligence leakage if business order volumes and pricing structures are exposed.
Official Vendor Advisories & References
The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.16.5 via the 'invoice_number (via document filename)' parameter. This makes it possible for unauthenticated attackers to extract another customer's complete invoice PDF — including billing identity, shipping address, private order notes, line items, prices, dates, order ID, and invoice number — delivered directly to the attacker's email as an order confirmation attachment. Exploitation requires the plugin's yearly invoice number reset option to be enabled, and the attacker's guest-checkout order must trigger a processing email within 60 seconds of a victim order that shares the same yearly-reset invoice number.
Frequently Asked SecOps Questions (CVE-2026-109217)
FAQQ1. How critical is CVE-2026-109217 and is it actively exploited in the wild?
CVE-2026-109217 is rated CVSS 5.3 (MEDIUM) with a 30-day EPSS exploitation probability of 0.3%. Organizations running affected versions should prioritize patching based on network exposure.
Q2. Which vendors and products are affected by CVE-2026-109217?
Primary impacted vendors include wpovernight across woocommerce-pdf-invoices-packing-slips. Scope summary: All versions of WooCommerce PDF Invoices & Packing Slips up to and including 5.16.5, when the yearly invoice number reset option is enabled
Q3. What temporary mitigations or workarounds exist for CVE-2026-109217 before patching?
[Mitigation] Immediately upgrade the plugin to version 5.16.6 or higher, and disable the yearly invoice number reset option as a temporary workaround Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2026-109217
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (wpovernight)
View Category →WordPress WooCommerce PDF Invoices & Packing Slips Stored XSS Vulnerability (CVE-2026-107750) Security Advisory
[Affected Scope] WordPress WooCommerce PDF Invoices & Packing Slips plugin versions up to, and including, 5.16.4
Ahsay AhsayCBS Replication Receiver Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-105134)
[Affected Scope] AhsayCBS versions up to 9.15.2.69 and 10.3.4.44, specifically the Replication Receiver component
Adobe Commerce (Magento) Server-Side Template Injection (SSTI) Remote Code Execution (CVE-2026-75650)
[Affected Scope] All unpatched versions of Adobe Commerce and Magento Open Source.
Metabase /reset_password Endpoint Unauthenticated SQL Injection and Admin Takeover (CVE-2026-72898)
[Affected Scope] Unpatched active instances of Metabase Open Source and Enterprise editions
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.