CVE-2026-11899 Overview
CVE-2026-11899 is an authorization bypass vulnerability in the PDF Builder for WooCommerce WordPress plugin. The plugin fails to properly verify user permissions before returning invoice metadata through an AJAX endpoint. Authenticated attackers holding subscriber-level access or above can retrieve invoice numbers, formatted invoice numbers, and creation timestamps for arbitrary WooCommerce orders. Exploitation requires only supplying OrderNumber and InvoiceId values along with a garbage nonce. All versions of the plugin up to and including 2.0.11 are affected. The issue is classified under CWE-862: Missing Authorization.
Critical Impact
Any authenticated user on an affected WooCommerce store can enumerate invoice metadata for orders belonging to other customers, exposing order sequence, invoice sequence, and transaction timing data.
Affected Products
- PDF Builder for WooCommerce. Create invoices, packing slips and more (WordPress plugin)
- All versions up to and including 2.0.11
- WordPress sites using the woo-pdf-invoice-builder plugin
Discovery Timeline
- 2026-09-19 - CVE-2026-11899 published to the National Vulnerability Database (NVD)
- 2026-09-21 - Last updated in NVD database
Technical Details for CVE-2026-11899
Vulnerability Analysis
The vulnerability resides in the plugin's AJAX handler for invoice lookups. The handler accepts POST parameters that identify an order and invoice, then returns invoice metadata to the caller. Although the handler is registered behind WordPress authentication, it does not enforce a per-order capability check. Any authenticated user, including default subscribers created through open registration, can invoke the endpoint.
The endpoint additionally treats an invalid nonce as non-blocking. Supplying arbitrary values in the nonce field does not stop the response from being returned. As a result, an attacker can iterate over sequential OrderNumber or InvoiceId values and harvest metadata for every order on the store. Exposed fields include the invoice number, the formatted invoice string, and the creation timestamp.
Root Cause
The root cause is missing authorization ([CWE-862]) in the AJAX processing layer. Referenced source files include utilities/HttpPostProcessor.php and woocommerce-pdf-invoice-ajax.php. The handler validates only that the request originates from a logged-in user. It does not verify that the user owns the requested order or holds a capability such as manage_woocommerce. Nonce enforcement is also absent from the response path.
Attack Vector
Exploitation is network-based and requires low-privilege authentication. An attacker registers a subscriber account, obtains a session cookie, and sends crafted POST requests to the vulnerable admin-ajax action. By incrementing the OrderNumber and InvoiceId parameters, the attacker enumerates invoice metadata across the store. No user interaction is required. See the WordPress Plugin Code Review and the Wordfence Vulnerability Report for the affected code paths.
Detection Methods for CVE-2026-11899
Indicators of Compromise
- Bursts of POST requests to admin-ajax.php from a single authenticated subscriber account.
- Sequential or incrementing OrderNumber and InvoiceId parameter values in request bodies.
- Requests containing invoice-related AJAX actions accompanied by malformed or repeated nonce values.
- New subscriber account registrations followed shortly by high-volume AJAX activity.
Detection Strategies
- Alert on any authenticated non-admin account issuing more than a defined threshold of invoice AJAX requests per minute.
- Correlate WooCommerce order IDs referenced in AJAX traffic against the requesting user's owned orders.
- Inspect web server access logs for repeated POST /wp-admin/admin-ajax.php entries carrying invoice action names from low-privilege sessions.
Monitoring Recommendations
- Enable WordPress and WooCommerce audit logging for all AJAX invoice endpoints.
- Forward web and application logs to a centralized analytics platform for baseline and anomaly detection.
- Monitor account creation events and flag new subscribers that immediately query order data.
How to Mitigate CVE-2026-11899
Immediate Actions Required
- Update the PDF Builder for WooCommerce plugin to a version newer than 2.0.11 as soon as the vendor releases a fix.
- Audit existing user accounts and remove unused or suspicious subscriber-level accounts.
- Disable open user registration on affected stores until the patched version is deployed.
- Review web access logs for evidence of invoice enumeration prior to patching.
Patch Information
The vendor addressed the issue in the plugin repository. See WordPress Plugin Changeset 3626297 for the corrective commit. Site operators should upgrade through the WordPress plugin manager and confirm the running version is above 2.0.11.
Workarounds
- Deactivate the PDF Builder for WooCommerce plugin until the patched release is installed.
- Restrict access to wp-admin/admin-ajax.php from unauthenticated and low-privilege sessions using a web application firewall rule.
- Set the WordPress default role for new registrations to a value that cannot access WooCommerce data, or disable public registration entirely.
- Apply virtual patching rules from your WAF vendor that specifically block the vulnerable AJAX action.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.