CVE-2026-13116 Overview
CVE-2026-13116 is an Insecure Direct Object Reference (IDOR) vulnerability [CWE-639] in the PDF Invoices & Packing Slips for WooCommerce plugin for WordPress. The flaw affects all versions up to and including 5.14.0. It resides in the generate_document_shortcode handler, which fails to validate a user-controlled key. Authenticated attackers with contributor-level access or higher can mint publicly accessible, session-free download links for arbitrary third-party orders. Exploitation requires the plugin's Document link access type setting to be configured to full; the default logged_in setting mitigates the issue by binding URLs to a per-session nonce.
Critical Impact
Attackers can enumerate and download invoices and packing slips for arbitrary orders, exposing customer names, billing and shipping addresses, email addresses, phone numbers, order and invoice numbers, line items, totals, payment details, and customer notes.
Affected Products
- PDF Invoices & Packing Slips for WooCommerce plugin for WordPress
- All versions up to and including 5.14.0
- Sites with the Document link access type setting configured to full
Discovery Timeline
- 2026-07-11 - CVE-2026-13116 published to NVD
- 2026-07-13 - Last updated in NVD database
Technical Details for CVE-2026-13116
Vulnerability Analysis
The vulnerability stems from an Insecure Direct Object Reference in the plugin's generate_document_shortcode function. The shortcode accepts a user-controlled key that identifies which order's document to generate. The plugin fails to verify that the requesting user is authorized to access the referenced order. As a result, any authenticated user with contributor-level privileges or above can request document links for arbitrary order identifiers.
The generated URLs are downloadable without an active session, allowing the attacker to share them or use them from an unauthenticated context. The exposed data includes complete customer PII, order contents, financial totals, and payment metadata contained in the invoice and packing slip documents.
Root Cause
The root cause is missing authorization validation on the user-supplied key parameter processed by the shortcode path. When the Document link access type is set to full, the plugin generates document URLs signed with the order_key rather than a per-session nonce. Because the shortcode does not verify ownership or role-based access to the target order, an attacker can mint valid links for any order in the store.
Attack Vector
An attacker registers or compromises a contributor-level (or higher) account on the target WordPress site. The attacker submits crafted shortcode requests that reference third-party order identifiers. The plugin returns signed URLs that download the corresponding PDF invoices and packing slips without further authentication. See the WooCommerce PDF Invoices Endpoint Code and WooCommerce PDF Invoices Frontend Code for the affected code paths.
No verified public exploit code is available. The vulnerability manifests in the shortcode processing logic; see the security advisory for technical details.
Detection Methods for CVE-2026-13116
Indicators of Compromise
- Unexpected HTTP requests from contributor-level accounts referencing the plugin's document shortcode or endpoint.
- Repeated document download requests iterating through sequential order identifiers or order_key values.
- Access log entries showing PDF invoice or packing slip downloads originating from IPs not tied to store administrators or customers.
Detection Strategies
- Audit the plugin's Document link access type setting; flag any deployment configured to full for immediate review.
- Correlate WordPress user role changes with subsequent shortcode or document-generation activity from low-privilege accounts.
- Monitor web server access logs for high-volume requests to plugin endpoints defined in Endpoint.php and Frontend.php.
Monitoring Recommendations
- Enable WordPress activity logging to record contributor and author-level actions, including shortcode submissions.
- Alert on newly registered accounts that quickly submit content containing document shortcodes.
- Track outbound document URL generation and flag URLs signed with order_key values not associated with the requesting user.
How to Mitigate CVE-2026-13116
Immediate Actions Required
- Update the PDF Invoices & Packing Slips for WooCommerce plugin to a version newer than 5.14.0 once the vendor releases a fix.
- Change the plugin's Document link access type setting from full to logged_in to restore per-session nonce validation.
- Review contributor-level and above accounts and remove any that are unused or unrecognized.
Patch Information
Refer to the WooCommerce PDF Changeset and the Wordfence Vulnerability Intel entry for the latest patched version and remediation guidance.
Workarounds
- Set the Document link access type to logged_in so that document URLs are signed with a per-session nonce rather than the order_key.
- Restrict new user registration or require administrator approval before assigning contributor-level roles.
- Temporarily disable the plugin on stores that must retain the full link access setting until a patched release is installed.
# Configuration example
# In WordPress admin: WooCommerce > PDF Invoices > Documents > General
# Set: Document link access type = logged_in
# Avoid: Document link access type = full
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
