PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-49056 WebToffee CVE debrief

CVE-2026-49056 is a high-severity vulnerability (CVSS Score: 7.5) affecting WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels plugin versions <= 4.9.4. This vulnerability allows unauthenticated sensitive data exposure. The vulnerability was published on [cvePublishedAt] and last modified on [cveModifiedAt].

Vendor
WebToffee
Product
WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-15
Original CVE updated
2026-06-15
Advisory published
2026-06-15
Advisory updated
2026-06-15

Who should care

Users of WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels plugin versions <= 4.9.4 should be aware of this vulnerability and take necessary actions to mitigate it.

Technical summary

The vulnerability has a CVSS vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N and is classified under CWE-497. It was reported by [email protected] and listed in the NVD database.

Defensive priority

high

Recommended defensive actions

  • Update WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels plugin to a version greater than 4.9.4.
  • Review and restrict access to sensitive data.

Evidence notes

Evidence for this CVE comes from the NVD database and Patchstack.

Official resources

CVE-2026-49056 was published on 2026-06-15T21:17:18.957Z and last modified on 2026-06-15T21:24:32.790Z.