CVE-2026-11496: PDF Builder for WooCommerce IDOR Vulnerability

CVE-2026-11496 Overview

CVE-2026-11496 is an Insecure Direct Object Reference (IDOR) vulnerability in the Woo PDF Invoice Builder plugin for WordPress, also distributed as PDF Builder for WooCommerce. The flaw affects all versions up to and including 2.0.8. The InspectOrder() AJAX handler in woocommerce-pdf-invoice-ajax.php performs no capability check and no nonce verification before loading an arbitrary WooCommerce order specified by an attacker-supplied OrderNumber POST field. Authenticated users with Subscriber-level access or above can enumerate order IDs and exfiltrate every order record on the site. The weakness is classified under CWE-862: Missing Authorization.

Critical Impact
Any authenticated user, including low-privileged Subscribers, can read every WooCommerce order on the site — including billing and shipping addresses, email, phone number, payment method, gateway transaction IDs, and order totals.

Affected Products

Woo PDF Invoice Builder plugin for WordPress, versions through 2.0.8
PDF Builder for WooCommerce (alternate distribution name), versions through 2.0.8
WordPress sites running WooCommerce with the vulnerable plugin installed

Discovery Timeline

2026-09-11 - CVE-2026-11496 published to the National Vulnerability Database
2026-09-11 - Last updated in NVD database

Technical Details for CVE-2026-11496

Vulnerability Analysis

The vulnerability resides in the InspectOrder() AJAX handler registered on the wp_ajax_rednao_wcpdfinv_inspect_order action inside woocommerce-pdf-invoice-ajax.php at line 513. The handler is registered on the authenticated wp_ajax_ hook, which means any logged-in user — including a Subscriber created through open WooCommerce registration — can invoke it. The handler does not call current_user_can() to validate capabilities and does not verify a nonce with check_ajax_referer(). Because WooCommerce customer accounts are frequently self-service, the practical attacker population is broad on any store that allows account creation.

Once invoked, the handler reads the OrderNumber value from the POST request and loads the corresponding order object directly. It then serializes the full WC_Order::get_data() payload along with post meta into the response. An attacker can iterate order IDs sequentially and collect the entire order history of the store. See the vulnerable handler source and the WCInspector utility for reference.

Root Cause

The root cause is missing authorization enforcement on a sensitive AJAX endpoint. The plugin trusts the attacker-supplied OrderNumber identifier and returns the object without confirming that the requesting user owns the order or holds a shop-management capability. This is a textbook [CWE-862] Insecure Direct Object Reference pattern.

Attack Vector

The attack is remote and requires only Subscriber-level authentication. An attacker registers a customer account, obtains a valid WordPress authentication cookie, and issues POST requests to /wp-admin/admin-ajax.php with action=rednao_wcpdfinv_inspect_order and an incrementing OrderNumber parameter. Each response returns the serialized order data. Automated iteration across the numeric order ID space extracts personally identifiable information (PII) and transaction metadata for every WooCommerce order on the site.

No verified public exploit code is available. Technical detail is documented in the Wordfence vulnerability report.

Detection Methods for CVE-2026-11496

Indicators of Compromise

POST requests to /wp-admin/admin-ajax.php containing action=rednao_wcpdfinv_inspect_order originating from Subscriber-level accounts.
High-volume sequential requests where the OrderNumber parameter increments across a wide range within a short time window.
Unexpected authenticated sessions from newly registered customer accounts issuing admin-ajax traffic.

Detection Strategies

Inspect web server access logs for the rednao_wcpdfinv_inspect_order action string, and correlate request volume per authenticated session.
Deploy a WordPress web application firewall (WAF) rule that blocks or rate-limits calls to the vulnerable AJAX action for users below the manage_woocommerce capability.
Alert on user agents or IP addresses issuing more admin-ajax requests than a typical customer session generates during checkout.

Monitoring Recommendations

Enable WooCommerce and WordPress audit logging to record AJAX action invocations tied to user IDs.
Forward WordPress and web server logs into a centralized analytics platform to baseline normal admin-ajax behavior and flag deviations.
Monitor new user registrations for anomalous patterns preceding bulk admin-ajax activity.

How to Mitigate CVE-2026-11496

Immediate Actions Required

Update the Woo PDF Invoice Builder plugin to the patched release published after version 2.0.8 — see the fix in the plugin changeset.
If patching is not immediately possible, deactivate and remove the plugin from affected WordPress sites.
Audit recent admin-ajax logs for exploitation attempts and, where evidence exists, notify affected customers in line with applicable data protection obligations.

Patch Information

The vendor addressed the flaw in the version following 2.0.8. The fix, visible in the WordPress plugin changeset, adds capability and nonce checks to the InspectOrder() handler. Download the current release from the Woo PDF Invoice Builder plugin page.

Workarounds

Disable customer self-registration in WooCommerce settings to reduce the pool of accounts able to reach the endpoint.
Use a WAF to block requests containing action=rednao_wcpdfinv_inspect_order until the plugin is updated.
Restrict access to /wp-admin/admin-ajax.php for known trusted networks where the store operating model permits.

bash

# Example WAF rule fragment to block the vulnerable AJAX action
# ModSecurity syntax
SecRule REQUEST_URI "@endsWith /wp-admin/admin-ajax.php" \
  "chain,phase:2,deny,status:403,id:1026114960,\
   msg:'Block CVE-2026-11496 Woo PDF Invoice Builder IDOR'"
  SecRule ARGS:action "@streq rednao_wcpdfinv_inspect_order"