CVE-2026-18027 webtoffee CVE debrief

Who should care

WordPress administrators, security teams, and users with subscriber-level access or above should assess exposure and prioritize remediation. This vulnerability can potentially expose sensitive information, and affected operators should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. Security teams should plan vendor-supported updates or mitigations through normal change control where exposure

Why it matters

CVE-2026-18027 is a Directory Traversal vulnerability in the WebToffee WooCommerce PDF Invoices plugin for WordPress. Authenticated attackers with subscriber-level access can exploit this to read arbitrary files, potentially exposing sensitive information. WordPress administrators and security teams should assess exposure, prioritize remediation, and monitor for exploitation attempts.

• Sensitive information disclosure
• Potential data breaches through file reading
• Increased risk of lateral movement within the network
• Need for urgent remediation and monitoring

Technical summary

The WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.9.8 via the get_image_src_in_base64 function. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.

Defensive priority

Assess exposure, prioritize remediation, and monitor for exploitation attempts

Recommended defensive actions

• Assess exposure by checking if the vulnerable plugin version is in use
• Prioritize remediation by updating to a fixed version
• Monitor for exploitation attempts and anomalous file access
• Verify file access controls and validate input sanitization
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability exists in versions up to 4.9.8 of the plugin. The Directory Traversal issue allows attackers to read arbitrary files via the get_image_src_in_base64 function. This function is used to generate base64-encoded file contents, which are then embedded into the cached invoice HTML. The plugin does not properly validate user input, allowing attackers to traverse the directory structure and access sensitive files. The base64-encoded file contents are served directly to the attacker via the plugin's own Print/Download invoice

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.