Description

The PDF Builder for WooCommerce. Create invoices,packing slips and more plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.0.11. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve invoice numbers, formatted invoice numbers, and creation timestamps for arbitrary WooCommerce orders by supplying any OrderNumber and InvoiceId values with a garbage nonce.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-19T08:16:51.760Z",
  "pubdate": "2026-09-19T08:16:51.760Z",
  "executiveSummary": "The PDF Builder for WooCommerce plugin contains a critical authorization bypass vulnerability affecting all versions up to and including 2.0.11.\nThe vulnerability originates from a failure to perform adequate capability checks when processing invoice data requests. This security oversight allows authenticated users, regardless of their low-privilege status (e.g., subscriber), to access sensitive order information.\nBy manipulating request parameters, an attacker can bypass access controls to retrieve non-public data, including invoice numbers, formatted invoice strings, and precise creation timestamps for arbitrary WooCommerce orders.\nThis represents a significant information disclosure risk, as it allows unauthorized parties to enumerate order metadata, which could be leveraged for reconnaissance, supply chain intelligence, or further exploitation within the WooCommerce environment.\nExploitation is straightforward and requires only a registered user account and the ability to craft HTTP requests with arbitrary OrderNumber and InvoiceId identifiers, even when paired with invalid nonce values.",
  "technicalDetails": "The vulnerability resides within the plugin's data retrieval logic, which fails to implement robust authorization checks prior to serving invoice details to the client.\nThe root cause is an improper implementation of nonce verification and authorization protocols in the handler responsible for processing invoice-related data requests. The application relies on client-supplied parameters for identifying the target order but fails to validate if the current user session possesses the appropriate 'manage_woocommerce' or 'edit_shop_order' capabilities.\nIn a standard WordPress execution flow, actions that return sensitive data should be gated by a strict permission check (e.g., current_user_can()). In the affected versions of PDF Builder for WooCommerce, this check is either missing or implemented in a way that is circumvented by the provided input parameters.\nThe exploitation method involves the attacker intercepting or crafting a request to the plugin's invoice retrieval endpoint. Even when a garbage (invalid) nonce is provided, the backend logic proceeds to fetch the requested record because the authorization layer fails to terminate the request upon invalid credentials or lack of permissions.\nAttackers can iterate through sequential OrderNumber and InvoiceId values to perform a mass exfiltration of invoice metadata. By targeting arbitrary identifiers, an attacker can extract data for any order present in the WooCommerce database, effectively bypassing the intended logical isolation of user orders.\nThe lack of proper nonce verification indicates that the plugin does not enforce CSRF protection or session-bound request integrity for this endpoint, further lowering the barrier for exploitation. Once the malicious request is sent, the server processes the database query and returns the structured invoice metadata in the response body, allowing the attacker to aggregate sensitive order information at scale.\nThe post-exploitation impact includes the loss of confidentiality regarding customer order volume, historical transaction patterns, and internal invoice numbering schemes. This information could be utilized in sophisticated social engineering campaigns targeting business operations or as a prerequisite for more advanced attacks targeting the underlying WooCommerce configuration."
}