Description

The WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.9.8 via the get_image_src_in_base64 function. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. The base64-encoded file contents are embedded into the cached invoice HTML and served directly to the attacker via the plugin's own Print/Download invoice endpoints, which require only a valid nonce and access key.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-23T00:16:50.370Z",
  "pubdate": "2026-08-23T00:16:50.370Z",
  "executiveSummary": "A directory traversal vulnerability exists in the WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels plugin for WordPress in all versions up to, and including, 4.9.8. This security flaw stems from insufficient input sanitization within the get_image_src_in_base64 function, allowing authenticated attackers with subscriber-level access and above to traverse the file system and read arbitrary files on the server.\nThe impact of successful exploitation includes the unauthorized disclosure of sensitive server-side files, which may contain configuration details, credentials, or other confidential system data. Attackers can leverage this capability by supplying crafted path inputs that are processed by the vulnerable function. The resulting base64-encoded file contents are embedded directly into cached invoice HTML documents.\nThese malicious artifacts are subsequently served to the attacker via the plugin's Print/Download invoice endpoints. Exploitation requirements include authenticated access at the subscriber privilege level, along with the acquisition of a valid nonce and access key associated with the targeted endpoint. The risk implications are significant due to the exposure of internal server files to low-privileged users.",
  "technicalDetails": "The vulnerability resides in the get_image_src_in_base64 function utilized by the WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels plugin for WordPress, affecting all versions up to and including 4.9.8. The root cause is inadequate path validation and sanitization, which fails to properly restrict file system access to designated directories when handling image or resource paths.\nExploitation of this directory traversal flaw requires an authenticated attacker with a minimum of subscriber-level privileges on the target WordPress site. The attack vector involves interacting with the plugin's Print/Download invoice endpoints, which expose the invoice generation and retrieval functionality. Although these endpoints require a valid nonce and access key, authenticated subscribers can typically obtain or interact with these parameters during normal application usage or specific workflow triggers.\nThe step-by-step attack flow proceeds as follows: First, the attacker identifies or obtains a valid nonce and access key for the plugin's invoice printing or downloading endpoints. Second, the attacker crafts a malicious request targeting the vulnerable get_image_src_in_base64 function, injecting directory traversal sequences (such as dot-dot-slash patterns) to target arbitrary files on the underlying server. Third, the application processes the traversal input, reads the contents of the targeted file, and encodes the data into a base64 format.\nFourth, the base64-encoded file contents are embedded directly into the cached invoice HTML generated by the plugin. Finally, the attacker retrieves the generated invoice through the Print/Download invoice endpoints, extracts the base64-encoded payload from the HTML source, and decodes it to reveal the plaintext contents of the arbitrary file. Post-exploitation impact is characterized by the potential leakage of sensitive system files, application source code, configuration files, or credentials accessible to the web server process."
}