The Woo PDF Invoice Builder plugin for WordPress, also distributed as 'PDF Builder for WooCommerce', is vulnerable to Insecure Direct Object Reference (IDOR) in all versions up to, and including, 2.0.8. This vulnerability exists due to the InspectOrder() AJAX handler, registered on wp_ajax_rednao_wcpdfinv_inspect_order, failing to perform a capability check and nonce verification before loading an arbitra [truncated]
CVE-2026-57393 is a MEDIUM severity vulnerability in WooCommerce PDF Invoice Builder, classified as an Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability, which allows Retrieve Embedded Sensitive Data. This vulnerability affects WooCommerce PDF Invoice Builder versions from n/a through <= 2.0.8. The issue has a CVSS score of 6.5 and a CVSS severity of MEDIUM. The CVSS [truncated]
A Missing Authorization vulnerability was found in Extra Product Options Builder for WooCommerce. This issue allows for Exploiting Incorrectly Configured Access Control Security Levels. The vulnerability affects Extra Product Options Builder for WooCommerce versions from n/a through <= 1.2.167. The CVSS score for this vulnerability is 6.5, classified as MEDIUM severity. The CVE record was published on 202 [truncated]
