CVE-2026-49056: WooCommerce PDF Invoices Plugin Unauthenticated Data Exposure

Technical summary

CVE-2026-49056 is an unauthenticated sensitive data exposure vulnerability (CWE-497) in the WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels plugin. The vulnerability allows remote attackers to access sensitive data over the network without providing credentials. The plugin fails to enforce proper access controls on endpoints or functions that return or generate PDF documents and related invoice metadata. The attack has low complexity—no special conditions or browser tricks are required—and results in confidentiality breach with no integrity or availability impact. The CVSS 3.1 score of 7.5 (HIGH) reflects network accessibility combined with high confidentiality impact.

Business impact

WooCommerce sites using this plugin face exposure of customer personally identifiable information (PII), order histories, shipping addresses, and potentially payment-related metadata. This can lead to regulatory compliance violations under GDPR, CCPA, and PCI DSS if payment card data is inadvertently exposed; reputational damage from data breach notifications; and increased liability if customer information is used for fraud or identity theft. E-commerce operators depend on customer trust; unauthorized disclosure of order and address data directly undermines that trust and may trigger customer churn and legal action.

Affected systems

The WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels plugin in versions 4.9.4 and earlier is vulnerable. Any WooCommerce store running this plugin at or below version 4.9.4 is at risk. The plugin is commonly deployed on small to mid-sized e-commerce sites. Sites using newer versions of the plugin are not affected, provided they have updated past the vulnerable release.

Exploitability

This vulnerability is highly exploitable. It requires no authentication, no special credentials, and no user interaction. An attacker only needs network access and can craft a direct request to the vulnerable plugin endpoint. No sophisticated techniques are needed; standard HTTP requests suffice. The low attack complexity and public disclosure create an urgent exploitation window. However, the vulnerability is not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog, meaning active exploitation in the wild has not been officially confirmed or tracked at the time of publication.

Remediation

Site operators must update the WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels plugin to a version newer than 4.9.4. After patching, audit access logs and backups to determine whether sensitive data may have been accessed. Consider implementing additional access controls and WAF rules to block direct requests to invoice and PDF generation endpoints. Rotate any customer data that was exposed and consider notifying affected customers if a breach is confirmed.

Patch guidance

Check the official WooCommerce plugin repository or the vendor's advisory for the patched version number. Update the plugin to the latest available release that supersedes version 4.9.4. Test the update in a staging environment first to ensure compatibility with your WooCommerce theme and other active plugins. After deployment to production, verify that PDF invoice generation and related functionality continue to work as expected and that the sensitive endpoints are no longer accessible without authentication.

Detection guidance

Monitor web server and WAF logs for unusual or repeated requests to paths containing terms such as 'invoice', 'pdf', 'packing-slip', 'shipping-label', or other PDF generation endpoints associated with the plugin. Look for requests lacking valid session tokens or authentication headers. Configure alerts for HTTP 200 responses on sensitive endpoints when no user session is present. Review any exported or downloaded PDF files in recent backups to identify if unauthorized access occurred. Network-based monitoring should flag anomalous outbound data transfers from the web server that coincide with these requests.

Why prioritize this

This vulnerability merits immediate remediation because it exposes sensitive customer and business data with zero barriers to exploitation. The CVSS score of 7.5 reflects high confidentiality impact. Any WooCommerce site running this plugin and connected to the public internet is vulnerable to opportunistic attack. The plugin is widely used, making this a common target. Delaying patching extends the window in which customer data remains at risk.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) is driven by: network accessibility (AV:N), low attack complexity (AC:L), no privilege requirement (PR:N), no user interaction needed (UI:N), and high confidentiality impact (C:H). The vulnerability does not alter or disrupt the system (I:N, A:N), so integrity and availability scores are zero. The score correctly reflects a serious but not critical exposure—data is compromised but the service remains online and functional. Organizations should treat this as a high-priority issue, not a critical emergency requiring immediate shutdown, but one requiring patches within days.

Frequently asked questions