CVE-2026-49056: WooCommerce PDF Invoices Data Exposure

CVE-2026-49056 Overview

CVE-2026-49056 is an unauthenticated sensitive data exposure vulnerability in the WordPress plugin WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels. The flaw affects plugin versions 4.9.4 and earlier. Remote attackers can retrieve sensitive information without authentication or user interaction. The weakness maps to [CWE-497]: Exposure of Sensitive System Information to an Unauthorized Control Sphere. WooCommerce stores hosting hundreds of thousands of orders rely on this plugin to generate invoices and shipping labels, expanding the potential impact.

Critical Impact
An unauthenticated network attacker can access sensitive customer and order data, including invoices, packing slips, and shipping label content, without any privileges or interaction.

Affected Products

WordPress plugin: WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels
All plugin versions <= 4.9.4
WooCommerce storefronts running the affected plugin slug print-invoices-packing-slip-labels-for-woocommerce

Discovery Timeline

2026-06-15 - CVE-2026-49056 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-49056

Vulnerability Analysis

The vulnerability allows unauthenticated remote access to sensitive resources generated by the plugin. The plugin produces invoices, packing slips, delivery notes, and shipping labels that contain customer personally identifiable information (PII), order details, billing addresses, and shipping data. An access control gap in the document handling logic exposes these documents to unauthenticated requests over the network.

The attack requires no authentication, no privileges, and no user interaction. Confidentiality is impacted while integrity and availability remain intact, consistent with a pure information disclosure flaw. EPSS data places exploit likelihood at 0.294% (20.867 percentile) as of 2026-06-18.

Root Cause

The root cause is improper access control on plugin endpoints or stored document resources that contain order data. The plugin fails to validate that the requester is authorized to retrieve the specific invoice or shipping document. This category aligns with [CWE-497], where sensitive system or business information is exposed to actors outside the intended control sphere.

Attack Vector

An attacker sends crafted HTTP requests over the network to the WordPress site hosting the vulnerable plugin. Because no authentication is required, attackers can enumerate or directly request document resources. Successful requests return content containing customer names, addresses, order line items, and other commerce-related PII. Refer to the Patchstack Vulnerability Advisory for additional technical context.

Detection Methods for CVE-2026-49056

Indicators of Compromise

Unauthenticated HTTP GET requests targeting plugin endpoints under /wp-content/plugins/print-invoices-packing-slip-labels-for-woocommerce/ or related AJAX actions.
Sequential or enumeration-style requests for invoice, packing slip, or shipping label identifiers in web server access logs.
Outbound traffic from unfamiliar IP ranges retrieving large volumes of PDF or document responses from the WordPress site.

Detection Strategies

Inventory all WordPress sites and identify those running the affected plugin at version <= 4.9.4 using plugin management tooling or filesystem scans.
Review web server and WAF logs for unauthenticated requests to plugin-handled invoice and shipping label endpoints.
Correlate access logs with WooCommerce order activity to find document retrievals that do not match legitimate admin or customer sessions.

Monitoring Recommendations

Enable verbose access logging on WordPress and forward logs to a centralized analytics platform for retention and search.
Alert on bursts of requests to plugin document endpoints from a single IP or user agent within short time windows.
Monitor for unauthenticated requests that successfully return 200 OK responses containing Content-Type: application/pdf from plugin paths.

How to Mitigate CVE-2026-49056

Immediate Actions Required

Upgrade the plugin to a version above 4.9.4 once the vendor publishes a fixed release.
Restrict access to plugin invoice and shipping label endpoints at the web server or WAF layer until patching is complete.
Audit historical access logs for prior unauthenticated retrievals and notify affected customers if PII was exposed.

Patch Information

Review the Patchstack Vulnerability Advisory for the latest patched version and vendor remediation guidance. Apply the fixed plugin release through the WordPress admin dashboard or via WP-CLI as soon as it is available.

Workarounds

Deploy WAF rules that require authenticated sessions for requests to the plugin's invoice and shipping document endpoints.
Temporarily deactivate the plugin on production stores if a vendor patch is unavailable and document generation can be paused.
Rotate or invalidate any predictable identifiers (such as invoice IDs) the plugin uses to reference documents, reducing enumeration risk.

bash

# Example: block unauthenticated access to plugin document endpoints via nginx
location ~* /wp-content/plugins/print-invoices-packing-slip-labels-for-woocommerce/ {
    # Allow only authenticated admin IP ranges
    allow 203.0.113.0/24;
    deny all;
}