rootpwn

medium · CVSS v3 4.3 · EPSS 0.00214

CVE-2026-11899

The PDF Builder for WooCommerce plugin for WordPress contains an authorization bypass vulnerability in versions up to 2.0.11. This flaw allo

Overview

The PDF Builder for WooCommerce plugin for WordPress contains an authorization bypass vulnerability in versions up to 2.0.11. This flaw allows authenticated users with low-level privileges to access sensitive order metadata, such as invoice numbers and timestamps, by bypassing nonce verification. It primarily affects e-commerce sites using this plugin to generate invoices and packing slips.

Description

The PDF Builder for WooCommerce. Create invoices,packing slips and more plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.0.11. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve invoice numbers, formatted invoice numbers, and creation timestamps for arbitrary WooCommerce orders by supplying any OrderNumber and InvoiceId values with a garbage nonce.

Impact

This vulnerability compromises data confidentiality by allowing unauthorized access to internal order details. Authenticated users, including those with subscriber-level permissions, can view invoice metadata belonging to other customers. While it does not allow full order modification or deletion, it exposes business-sensitive information and customer transaction history.

Remediation

Update the PDF Builder for WooCommerce plugin to the latest version (at least 2.0.12) where proper authorization checks and nonce verification are implemented. If an immediate update is not possible, restrict subscriber-level access to the WordPress dashboard and monitor for unusual activity involving order metadata requests.

Risk context

With a CVSS score of 4.3 (Medium) and a low EPSS of 0.00214, the immediate risk of widespread automated exploitation is relatively low. However, the requirement for only subscriber-level authentication makes it a significant concern for sites with open registration or large user bases.

Affected products

  • WordPress
  • PDF Builder for WooCommerce <= 2.0.11
  • WooCommerce

Scores

Severity
medium
CVSS v2
4
CVSS v3
4.3
CVSS v4
—
EPSS
0.00214

WordPress WooCommerce Authorization Bypass Information Disclosure Plugin Security IDOR

← All CVEs

Related CVEs

medium

CVE-2026-12042

The WP2Social Auto Publish plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) within its administrative settings. This vulnerability exists in all versions up to 2.4.12 due to inadequate input sanitization and output escaping of user-provided data.

View analysis

medium

CVE-2026-15660

The SEO Booster plugin for WordPress versions up to 7.4.7 suffers from a missing authorization check that allows any authenticated user with Subscriber role or higher to overwrite critical options. This can disrupt the Google Search Console integration and inject attacker‑supplied data into site options. The flaw is exploitable via a crafted /wp-admin/ URL that triggers the vulnerable handle_oauth_callback function.

View analysis

medium

CVE-2026-15760

The Divi Essential plugin for WordPress contains a vulnerability in its AJAX handlers that allows authenticated users to access sensitive database information. Due to missing authorization checks and bypassable security tokens, any user with Subscriber-level access can enumerate and read arbitrary database tables. This exposure includes critical data such as user credentials, session tokens, and site configuration settings.

View analysis

medium

CVE-2025-15698

The Business Name Generator plugin for WordPress, up to version 1.3, contains a vulnerability where configuration settings are not properly sanitized or escaped. This allows high-privileged users to inject malicious scripts into the application's database, which are then executed when the settings page is viewed.

View analysis