CVE-2026-18027

Name of the Vulnerable Software and Affected Versions WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels versions prior to 4.9.9

Description An issue exists in the get image src in base64() function that allows authenticated users with subscriber-level access or higher to perform Directory Traversal. This enables the reading of arbitrary files from the server, potentially exposing sensitive information. The process involves the customer note parameter, where base64-encoded file contents are embedded into cached invoice HTML and delivered through the plugin's Print/Download invoice endpoints using a valid nonce and access key.

Recommendations Update to a version newer than 4.9.8. As a temporary mitigation, restrict access to the get image src in base64() function or the customer note parameter until the update is applied.