CVE-2026-11496 edgarrojas CVE debrief

Who should care

Defenders of WooCommerce environments using the Woo PDF Invoice Builder plugin should assess exposure and prioritize remediation, especially those with Subscriber-level access, to prevent potential data breaches and unauthorized access to sensitive information.

Why it matters

The Woo PDF Invoice Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference, allowing authenticated attackers with Subscriber-level access to read every WooCommerce order on the site, potentially leading to data breaches and unauthorized access to sensitive information.

• Authenticated attackers with Subscriber-level access can read every WooCommerce order on the site
• Exposure of sensitive order information, including billing/shipping address, email, phone number, payment method, gateway transaction ID, and order totals
• Potential for data breaches and unauthorized access to sensitive information

Technical summary

The Woo PDF Invoice Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.8. This is due to the InspectOrder() AJAX handler performing no capability check and no nonce verification before loading an arbitrary order by the attacker-supplied 'OrderNumber' POST field and serializing its full WC_Order::get_data() and meta to the response.

Defensive priority

Defenders should prioritize verifying and remediating this vulnerability in WooCommerce environments, especially those with Subscriber-level access.

Recommended defensive actions

• Verify and remediate the vulnerability in WooCommerce environments
• Restrict access to sensitive order information
• Monitor for potential exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is due to the InspectOrder() AJAX handler performing no capability check and no nonce verification before loading an arbitrary order. This allows attackers to read every WooCommerce order on the site, including sensitive information such as billing/shipping address, email, phone number, payment method, gateway transaction ID, and order totals.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.