CVE-2026-93746 webtoffee CVE debrief

Who should care

Defenders responsible for WordPress installations with the WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels plugin should assess exposure and prioritize remediation.

Why it matters

CVE-2026-93746 is a high-severity vulnerability in the WebToffee WooCommerce PDF Invoices plugin, allowing unauthenticated access to order documents. Defenders should prioritize verification and remediation.

• Unauthenticated attackers can access order documents, including customer name, billing/shipping address, phone number, purchased products, prices, taxes, and invoice metadata.
• Defenders need to verify if vulnerable versions are installed and restrict access to order documents.
• Remediation priority is high due to the potential for unauthorized access to sensitive information.

Technical summary

The WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.0.2 via the 'email' parameter of the guest print_document_from_the_mail_link handler dispatched from print_window() on init. This is due to the handler authorizing access to an order's printable documents when the attacker-supplied (base64-encoded) 'email' equals the order's billing email — a non-secret identifier — instead of requiring the WooCommerce order_key. This makes it possible for unauthenticated attackers, when the site is configured to allow guest access to documents ('wt_pklist_print_button_access_for' != 'l

Defensive priority

Defenders should prioritize verifying exposure and remediating vulnerable installations.

Recommended defensive actions

• Verify if the WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels plugin is installed and if its version is 5.0.2 or earlier.
• Check if the site allows guest access to documents.
• Restrict access to order documents to authenticated users only.
• Update the plugin to a version that fixes the vulnerability, if available.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability exists in versions up to and including 5.0.2 of the WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels plugin. The insecure direct object reference allows access to order documents via the 'email' parameter.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.