CVE-2026-18027: WooCommerce PDF Invoices Path Traversal

CVE-2026-18027 Overview

CVE-2026-18027 is a directory traversal vulnerability in the WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels plugin for WordPress. The flaw affects all versions up to and including 4.9.8. The vulnerable get_image_src_in_base64 function fails to properly restrict file path inputs. Authenticated attackers with subscriber-level access can read arbitrary files on the server. The base64-encoded file contents are embedded into cached invoice HTML and returned through the plugin's Print/Download invoice endpoints, which only require a valid nonce and access key. This exposes configuration files, credentials, and other sensitive data stored on the underlying host.

Critical Impact
Authenticated subscribers can exfiltrate arbitrary server-side files, including wp-config.php, exposing database credentials and WordPress secret keys.

Affected Products

WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels plugin for WordPress
All plugin versions up to and including 4.9.8
WordPress sites running WooCommerce with the vulnerable plugin installed

Discovery Timeline

2026-08-23 - CVE-2026-18027 published to NVD
2026-08-24 - Last updated in NVD database

Technical Details for CVE-2026-18027

Vulnerability Analysis

The vulnerability resides in the get_image_src_in_base64 function within the plugin's customizer and invoice modules. The function accepts an image source path used during invoice rendering and returns the corresponding file's base64-encoded contents. Because the input path is not validated against a whitelist or restricted to allowed directories, an attacker can supply traversal sequences such as ../../../../ to escape the intended image directory. The resulting base64 payload is embedded directly into the generated invoice HTML and cached. The plugin then serves this cached invoice through its Print/Download endpoints. Any authenticated user with a valid nonce and access key can retrieve the response and decode arbitrary server files. The issue is classified under CWE-22: Improper Limitation of a Pathname to a Restricted Directory.

Root Cause

The plugin trusts caller-supplied file path parameters passed to get_image_src_in_base64 without normalizing the path or verifying that the resolved location remains within the plugin's expected asset directories. See the vulnerable code paths in the WordPress Customizer Class Code and the WordPress Invoice Module Code.

Attack Vector

An attacker authenticates to WordPress with subscriber-level credentials or higher. Self-registration is enabled on many WooCommerce storefronts, lowering the practical barrier. The attacker triggers invoice generation with a manipulated image source path referencing sensitive files such as wp-config.php, /etc/passwd, or backup archives. The attacker then requests the invoice through the Print/Download endpoint using a valid nonce and access key, receives the cached HTML containing the base64 blob, and decodes the target file locally.

For technical details, refer to the Wordfence Vulnerability Analysis and the WordPress Plugin Changeset #3646629 which contains the vendor fix.

Detection Methods for CVE-2026-18027

Indicators of Compromise

HTTP requests to invoice-related endpoints containing path traversal sequences such as ../, ..%2F, or URL-encoded null bytes in image or asset parameters.
Cached invoice HTML files under the plugin's cache directory containing base64-encoded blobs that decode to non-image content like PHP source or system configuration.
Repeated Print/Download invoice requests from low-privilege user accounts, especially newly registered subscribers.
Unexpected access patterns to files outside the WordPress uploads directory originating from the PHP-FPM or web server process.

Detection Strategies

Inspect web server access logs for query strings targeting the plugin's customizer and invoice endpoints with directory traversal patterns.
Correlate subscriber-level session activity with invoice generation events; subscribers should not routinely generate invoices for arbitrary orders.
Deploy Web Application Firewall (WAF) rules that block traversal sequences in parameters consumed by get_image_src_in_base64.
Baseline expected file reads by the WordPress process and alert on reads of sensitive files such as wp-config.php, SSH keys, or shell history.

Monitoring Recommendations

Enable verbose logging on the WordPress plugin cache directory and monitor for new HTML files containing base64 payloads larger than typical embedded images.
Alert on any HTTP 200 response from Print/Download invoice endpoints when the requester holds only subscriber privileges.
Track creation of new WordPress user accounts followed shortly by invoice-related API calls.

How to Mitigate CVE-2026-18027

Immediate Actions Required

Update the WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels plugin to a version later than 4.9.8 that includes the fix from changeset #3646629.
Audit WordPress user accounts for unexpected subscriber registrations and remove accounts that appear inauthentic.
Rotate credentials stored in wp-config.php, including database passwords and WordPress authentication salts, if compromise is suspected.
Purge the plugin's invoice cache directory to remove any pre-generated invoices containing sensitive file contents.

Patch Information

The vendor addressed the traversal issue in the release following 4.9.8. The fix is committed in WordPress Plugin Changeset #3646629. Site administrators should apply the update through the WordPress plugin dashboard or via WP-CLI and verify the installed version reports higher than 4.9.8.

Workarounds

Disable the plugin until the patched version can be installed if immediate updating is not feasible.
Restrict WordPress registration by disabling open subscriber sign-up in Settings > General.
Deploy WAF signatures blocking ../ and encoded traversal variants on requests to /wp-admin/admin-ajax.php and Print/Download invoice URLs.
Apply filesystem-level controls with open_basedir in PHP to constrain readable paths to the WordPress installation directory.

bash

# Configuration example: constrain PHP file access with open_basedir
# Add to php.ini or site-specific PHP configuration
open_basedir = "/var/www/html/wordpress/:/tmp/"

# Update the vulnerable plugin via WP-CLI
wp plugin update print-invoices-packing-slip-labels-for-woocommerce

# Verify installed version is greater than 4.9.8
wp plugin get print-invoices-packing-slip-labels-for-woocommerce --field=version