{"vulnerability": "cve-2026-93746", "sightings": [{"uuid": "64ecb16c-8b0d-4509-8e72-375eb5dd94c5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-93746", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117415552534791098", "content": "CVE-2026-93746 WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels <= 5.0.2 - Insecure Direct Object Reference to Unauthenticated Unauthorized Order Document Access via 'email' Parameter The WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.0.2 via the 'email' parameter of the guest print_document_from_the_mail_link handler dispatched from print_window() on init. This is due to the handler authorizing access to an order's printable documents when the attacker-supplied (base64-encoded) 'email' equals the order's billing email \u2014 a non-secret identifier \u2014 instead of requiring the WooCommerce order_key. This makes it possible for unauthenticated attackers, when the site is configured to allow guest access to documents ('wt_pklist_print_button_access_for' != 'logged_in'), to retrieve any other customer's invoice, packing slip, delivery note, dispatch label or shipping label \u2014 including customer name, billing/shipping address, phone number, purchased products, prices, taxes and invoice metadata \u2014 by knowing the target order ID and the associated billing email address.\nhttps://www.cve.org/CVERecord?id=CVE-2026-93746https://www.wordfence.com/threat-intel/vulnerabilities/id/cf5ccfe6-c0e3-412f-9a93-2ccabb9997e7?source=cvehttps://plugins.trac.wordpress.org/browser/print-invoices-packing-slip-labels-for-woocommerce/tags/5.0.1/admin/class-wf-woocommerce-packing-list-admin.php#L1149https://plugins.trac.wordpress.org/browser/print-invoices-packing-slip-labels-for-woocommerce/tags/5.0.1/admin/class-wf-woocommerce-packing-list-admin.php#L1128https://plugins.trac.wordpress.org/browser/print-invoices-packing-slip-labels-for-woocommerce/tags/5.0.1/admin/class-wf-woocommerce-packing-list-admin.php#L1127https://plugins.trac.wordpress.org/browser/print-invoices-packing-slip-labels-for-woocommerce/tags/5.0.1/admin/class-wf-woocommerce-packing-list-admin.php#L990https://plugins.trac.wordpress.org/changeset?reponame=&new=3718644%40print-invoices-packing-slip-labels-for-woocommerce%2Ftags%2F5.0.3&old=3707093%40print-invoices-packing-slip-labels-for-woocommerce%2Ftags%2F5.0.2#wordpress #webtoffee #WebToffeeWooCommercePDFInvoices,PackingSlips,DeliveryNotes&ShippingLabels#CVE_2026_93746#bot", "creation_timestamp": "2026-10-10T07:59:09.394932Z"}, {"uuid": "e803591a-1e96-416c-946b-d5a075573673", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-93746", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mxkcl7gvs424", "content": "\ud83d\udfe0 CVE-2026-93746 - High (7.5)\n\nThe WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels plugin fo...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-93746/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-10-10T20:16:05.070098Z"}]}