CVE-2026-11496 edgarrojas CVE debrief

Who should care

Defenders responsible for WordPress sites using the Woo PDF Invoice Builder plugin, particularly those with Subscriber-level access or above, should assess exposure and implement compensating controls to prevent unauthorized order access.

Why it matters

The Woo PDF Invoice Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference, allowing authenticated attackers with Subscriber-level access to read every WooCommerce order on the site. Defenders should prioritize verifying exposure and implementing compensating controls to prevent unauthorized order access.

• Authenticated attackers with Subscriber-level access can read every WooCommerce order on the site, including sensitive information such as billing/shipping address, email, phone number, payment method, gateway transaction ID, and order totals.
• Defenders need to verify exposure and implement compensating controls to prevent unauthorized order access.
• The vulnerability requires verification of inventory and monitoring for suspicious activity related to order access.

Technical summary

The Woo PDF Invoice Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.8. This is due to the InspectOrder() AJAX handler performing no capability check and no nonce verification before loading an arbitrary order by the attacker-supplied 'OrderNumber' POST field and serializing its full WC_Order::get_data() and meta to the response.

Defensive priority

Defenders should prioritize verifying exposure and implementing compensating controls to prevent unauthorized order access.

Recommended defensive actions

• Verify exposure by confirming if the Woo PDF Invoice Builder plugin version 2.0.8 or earlier is installed and if the InspectOrder() AJAX handler is accessible.
• Implement compensating controls to restrict access to the InspectOrder() AJAX handler, ensuring only authorized users can access order information.
• Monitor for suspicious activity related to order access, implementing logging and alerting mechanisms to detect potential exploitation attempts.
• Update the plugin to a fixed version as soon as it becomes available, and confirm that the update addresses the IDOR vulnerability.
• Review and enhance the security of the WordPress site, focusing on user access controls and the principle of least privilege for Subscriber-level users and above.
• Conduct a thorough review of WooCommerce order data to identify any potential unauthorized access or data breaches resulting from this vulnerability.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability exists in the InspectOrder() AJAX handler, which performs no capability check and no nonce verification before loading an arbitrary order by the attacker-supplied 'OrderNumber' POST field.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.