CVE-2026-93746

Name of the Vulnerable Software and Affected Versions WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels versions prior to 5.0.3

Description An Insecure Direct Object Reference exists in the guest print document from the mail link handler dispatched from print window() on init. The issue occurs because the handler authorizes access to printable documents if the base64-encoded email parameter matches the order's billing email, which is a non-secret identifier, rather than requiring the WooCommerce order key. When the site is configured to allow guest access to documents (where wt pklist print button access for is not set to logged in), unauthenticated attackers can retrieve sensitive customer information—including names, billing and shipping addresses, phone numbers, purchased products, prices, taxes, and invoice metadata—by providing the target order ID and the associated billing email address.

Recommendations Update to a version newer than 5.0.2. As a temporary mitigation, set the wt pklist print button access for configuration to logged in to restrict document access to authenticated users.