{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-93746",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-11T16:37:08.285423Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-11T16:55:15.249Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes \u0026 Shipping Labels",
          "vendor": "webtoffee",
          "versions": [
            {
              "lessThanOrEqual": "5.0.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Brian Mungai"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes \u0026 Shipping Labels plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.0.2 via the \u0027email\u0027 parameter of the guest print_document_from_the_mail_link handler dispatched from print_window() on init. This is due to the handler authorizing access to an order\u0027s printable documents when the attacker-supplied (base64-encoded) \u0027email\u0027 equals the order\u0027s billing email \u2014 a non-secret identifier \u2014 instead of requiring the WooCommerce order_key. This makes it possible for unauthenticated attackers, when the site is configured to allow guest access to documents (\u0027wt_pklist_print_button_access_for\u0027 != \u0027logged_in\u0027), to retrieve any other customer\u0027s invoice, packing slip, delivery note, dispatch label or shipping label \u2014 including customer name, billing/shipping address, phone number, purchased products, prices, taxes and invoice metadata \u2014 by knowing the target order ID and the associated billing email address."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639 Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-10T07:41:48.536Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/cf5ccfe6-c0e3-412f-9a93-2ccabb9997e7?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/print-invoices-packing-slip-labels-for-woocommerce/tags/5.0.1/admin/class-wf-woocommerce-packing-list-admin.php#L1149"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/print-invoices-packing-slip-labels-for-woocommerce/tags/5.0.1/admin/class-wf-woocommerce-packing-list-admin.php#L1128"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/print-invoices-packing-slip-labels-for-woocommerce/tags/5.0.1/admin/class-wf-woocommerce-packing-list-admin.php#L1127"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/print-invoices-packing-slip-labels-for-woocommerce/tags/5.0.1/admin/class-wf-woocommerce-packing-list-admin.php#L990"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026new=3718644%40print-invoices-packing-slip-labels-for-woocommerce%2Ftags%2F5.0.3\u0026old=3707093%40print-invoices-packing-slip-labels-for-woocommerce%2Ftags%2F5.0.2"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-18T16:22:09.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-10-09T19:11:05.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes \u0026 Shipping Labels \u003c= 5.0.2 - Insecure Direct Object Reference to Unauthenticated Unauthorized Order Document Access via \u0027email\u0027 Parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-93746",
    "datePublished": "2026-10-10T07:41:48.536Z",
    "dateReserved": "2026-09-18T16:07:05.185Z",
    "dateUpdated": "2026-10-11T16:55:15.249Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-93746\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-10-11T16:37:08.285423Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-10-11T16:45:26.065Z\"}}], \"cna\": {\"title\": \"WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes \u0026 Shipping Labels \u003c= 5.0.2 - Insecure Direct Object Reference to Unauthenticated Unauthorized Order Document Access via \u0027email\u0027 Parameter\", \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Brian Mungai\"}], \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.5, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\"}}], \"affected\": [{\"vendor\": \"webtoffee\", \"product\": \"WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes \u0026 Shipping Labels\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.0.2\"}], \"defaultStatus\": \"unaffected\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2026-09-18T16:22:09.000Z\", \"value\": \"Vendor Notified\"}, {\"lang\": \"en\", \"time\": \"2026-10-09T19:11:05.000Z\", \"value\": \"Disclosed\"}], \"references\": [{\"url\": \"https://www.wordfence.com/threat-intel/vulnerabilities/id/cf5ccfe6-c0e3-412f-9a93-2ccabb9997e7?source=cve\"}, {\"url\": \"https://plugins.trac.wordpress.org/browser/print-invoices-packing-slip-labels-for-woocommerce/tags/5.0.1/admin/class-wf-woocommerce-packing-list-admin.php#L1149\"}, {\"url\": \"https://plugins.trac.wordpress.org/browser/print-invoices-packing-slip-labels-for-woocommerce/tags/5.0.1/admin/class-wf-woocommerce-packing-list-admin.php#L1128\"}, {\"url\": \"https://plugins.trac.wordpress.org/browser/print-invoices-packing-slip-labels-for-woocommerce/tags/5.0.1/admin/class-wf-woocommerce-packing-list-admin.php#L1127\"}, {\"url\": \"https://plugins.trac.wordpress.org/browser/print-invoices-packing-slip-labels-for-woocommerce/tags/5.0.1/admin/class-wf-woocommerce-packing-list-admin.php#L990\"}, {\"url\": \"https://plugins.trac.wordpress.org/changeset?reponame=\u0026new=3718644%40print-invoices-packing-slip-labels-for-woocommerce%2Ftags%2F5.0.3\u0026old=3707093%40print-invoices-packing-slip-labels-for-woocommerce%2Ftags%2F5.0.2\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"The WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes \u0026 Shipping Labels plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.0.2 via the \u0027email\u0027 parameter of the guest print_document_from_the_mail_link handler dispatched from print_window() on init. This is due to the handler authorizing access to an order\u0027s printable documents when the attacker-supplied (base64-encoded) \u0027email\u0027 equals the order\u0027s billing email \\u2014 a non-secret identifier \\u2014 instead of requiring the WooCommerce order_key. This makes it possible for unauthenticated attackers, when the site is configured to allow guest access to documents (\u0027wt_pklist_print_button_access_for\u0027 != \u0027logged_in\u0027), to retrieve any other customer\u0027s invoice, packing slip, delivery note, dispatch label or shipping label \\u2014 including customer name, billing/shipping address, phone number, purchased products, prices, taxes and invoice metadata \\u2014 by knowing the target order ID and the associated billing email address.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-639\", \"description\": \"CWE-639 Authorization Bypass Through User-Controlled Key\"}]}], \"providerMetadata\": {\"orgId\": \"b15e7b5b-3da4-40ae-a43c-f7aa60e62599\", \"shortName\": \"Wordfence\", \"dateUpdated\": \"2026-10-10T07:41:48.536Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-93746\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-10-11T16:55:15.249Z\", \"dateReserved\": \"2026-09-18T16:07:05.185Z\", \"assignerOrgId\": \"b15e7b5b-3da4-40ae-a43c-f7aa60e62599\", \"datePublished\": \"2026-10-10T07:41:48.536Z\", \"assignerShortName\": \"Wordfence\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}