CVE-2026-13116 wpovernight CVE debrief

Who should care

Authenticated attackers with contributor-level access and above should be cautious as they can mint publicly accessible, session-free download links for arbitrary third-party orders. Operators of WooCommerce sites using the affected plugin should review and update the plugin to prevent exploitation.

Technical summary

The vulnerability exists in the PDF Invoices & Packing Slips for WooCommerce plugin for WordPress, specifically in the generate_document_shortcode function. The issue arises from missing validation on a user-controlled key, allowing attackers to access sensitive information such as customer names, billing and shipping addresses, email addresses, phone numbers, order and invoice numbers, line items, totals, payment details, and customer notes.

Defensive priority

Medium priority due to the CVSS score of 4.3 and the potential for sensitive information disclosure.

Recommended defensive actions

• Review and update the plugin to a version beyond 5.14.0.
• Restrict access to the generate_document_shortcode function.
• Implement additional validation and sanitization for user-controlled input.
• Monitor for suspicious activity and implement logging and alerting mechanisms.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The vulnerability was reported by [email protected] and is publicly disclosed in the CVE record and NVD detail pages. The reporter provided evidence of the vulnerability, but details are limited. Defenders should verify affected product deployments and review official advisories for validation.

Official resources