CVE-2026-11899

Name of the Vulnerable Software and Affected Versions PDF Builder for WooCommerce. Create invoices,packing slips and more versions prior to 2.0.12

Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Authenticated attackers with subscriber-level access or higher can retrieve invoice numbers, formatted invoice numbers, and creation timestamps for arbitrary WooCommerce orders. This is achieved by providing any OrderNumber and InvoiceId values along with a garbage nonce (a number used once to prevent replay attacks).

Recommendations Update to version 2.0.12 or later.