CVE-2026-109217

Name of the Vulnerable Software and Affected Versions PDF Invoices & Packing Slips for WooCommerce versions prior to 5.16.6

Description An issue exists that allows unauthenticated attackers to extract a different customer's complete invoice PDF. This exposure includes billing identity, shipping address, private order notes, line items, prices, dates, order ID, and invoice number, which are delivered to the attacker's email as an order confirmation attachment. The flaw is triggered via the invoice number (via document filename) parameter. Exploitation is possible if the plugin's yearly invoice number reset option is enabled and the attacker's guest-checkout order triggers a processing email within 60 seconds of a victim order that shares the same yearly-reset invoice number.

Recommendations Update to version 5.16.6 or later. Disable the yearly invoice number reset option as a temporary mitigation measure.