CVE-2026-13116

Name of the Vulnerable Software and Affected Versions PDF Invoices & Packing Slips for WooCommerce versions prior to 5.14.1

Description An Insecure Direct Object Reference (IDOR) exists in the generate document shortcode function due to missing validation on a user-controlled key. Authenticated attackers with contributor-level access or higher can generate publicly accessible, session-free download links for arbitrary third-party orders. This leads to the exposure of sensitive data, including customer names, billing and shipping addresses, email addresses, phone numbers, order and invoice numbers, line items, totals, payment details, and customer notes. This issue is exploitable when the Document link access type setting is configured to 'full'; if set to the default 'logged in' value, the shortcode path is not exploitable for unauthorized access because URLs are signed with a per-session nonce.

Recommendations Update to a version newer than 5.14.0. Change the Document link access type setting from 'full' to 'logged in' to prevent unauthorized access to order documents.