CVE-2026-56060: WooCommerce Plugin Data Exposure Flaw

CVE-2026-56060 Overview

CVE-2026-56060 is an unauthenticated sensitive data exposure vulnerability in the Print Invoice & Delivery Notes for WooCommerce plugin for WordPress. The flaw affects versions up to and including 7.1.1 and allows remote attackers to access sensitive information without authentication. The vulnerability is classified under [CWE-497] (Exposure of Sensitive System Information to an Unauthorized Control Sphere).

Attackers can retrieve invoice and delivery note data over the network without any credentials or user interaction. The confidentiality impact is high, while integrity and availability remain unaffected. The vulnerability was published to the National Vulnerability Database (NVD) on 2026-06-26.

Critical Impact
Unauthenticated remote attackers can access customer order details, invoices, and delivery notes exposing personally identifiable information (PII) and business transaction data.

Affected Products

Print Invoice & Delivery Notes for WooCommerce plugin (WordPress)
Plugin versions 7.1.1 and earlier
WordPress sites running WooCommerce with the vulnerable plugin installed

Discovery Timeline

2026-06-26 - CVE-2026-56060 published to NVD
2026-06-26 - Last updated in NVD database

Technical Details for CVE-2026-56060

Vulnerability Analysis

The vulnerability resides in the Print Invoice & Delivery Notes for WooCommerce plugin, which generates printable invoices and delivery notes for WooCommerce orders. The plugin exposes endpoints or resources containing sensitive order information without enforcing authentication or authorization checks. Any remote user can access this data by issuing crafted HTTP requests to the affected WordPress site.

The classification under [CWE-497] indicates that the plugin discloses information that should be restricted to authorized users. Exposed data typically includes customer names, billing and shipping addresses, purchased products, order totals, and other order metadata. The attack requires no privileges and no user interaction, making automated mass exploitation trivial.

With an EPSS probability of 0.303%, the vulnerability has a moderate likelihood of exploitation attempts in the near term. However, the ease of exploitation and the value of exposed data raise the practical risk for site operators handling customer transactions.

Root Cause

The root cause is missing access control on resources that render or serve invoice and delivery note content. The plugin does not verify whether the requesting user has permission to view a specific order before returning its data. This design flaw allows enumeration and retrieval of order records by unauthenticated actors.

Attack Vector

An attacker sends HTTP requests to the vulnerable plugin endpoints from any network-reachable location. The requests target invoice or delivery note resources associated with WooCommerce orders. Because no session, nonce, or capability check gates the response, the server returns sensitive order data. Attackers can automate enumeration to harvest bulk customer and transaction data from affected stores.

Refer to the Patchstack Vulnerability Report for additional technical context.

Detection Methods for CVE-2026-56060

Indicators of Compromise

Unusual volumes of unauthenticated HTTP requests targeting plugin endpoints under paths related to woocommerce-delivery-notes or invoice printing functionality.
Sequential or enumerated order_id or similar identifier parameters in web server access logs from a single source IP.
Outbound access to invoice or delivery note URLs from IP addresses not associated with authenticated administrator or customer sessions.

Detection Strategies

Review WordPress and web server access logs for requests to plugin routes returning HTTP 200 status without accompanying authentication cookies.
Deploy a Web Application Firewall (WAF) rule to flag unauthenticated access attempts against invoice and delivery note endpoints.
Correlate spikes in plugin endpoint requests with the absence of wp_logged_in session cookies to identify unauthorized scraping.

Monitoring Recommendations

Enable verbose logging on the WordPress site and forward logs to a centralized SIEM for anomaly analysis.
Set alerts on high-frequency requests to /wp-admin/admin-ajax.php or plugin-specific routes originating from unauthenticated sources.
Monitor for data exfiltration patterns such as sequential identifier enumeration or large response payloads from invoice endpoints.

How to Mitigate CVE-2026-56060

Immediate Actions Required

Update the Print Invoice & Delivery Notes for WooCommerce plugin to a version later than 7.1.1 as soon as a patched release is available.
If no patch is available, disable or uninstall the plugin until a fix is released by the vendor.
Audit web server logs for evidence of prior unauthorized access to invoice or delivery note endpoints.

Patch Information

Consult the Patchstack Vulnerability Report for the latest patch status and vendor-supplied fixed version. Apply updates through the WordPress plugin management interface once the vendor releases a corrected version above 7.1.1.

Workarounds

Restrict access to plugin endpoints at the web server or WAF layer, requiring authentication cookies before serving invoice or delivery note resources.
Deploy virtual patching rules from a managed WordPress security provider to block unauthenticated requests to the vulnerable endpoints.
Temporarily disable the plugin and rely on manual invoice generation until an official fix is applied.

bash

# Example WAF rule (ModSecurity) to block unauthenticated invoice endpoint access
SecRule REQUEST_URI "@rx /(print-invoice|delivery-note|wcdn)" \
    "id:1056060,phase:1,deny,status:403,\
    chain,msg:'CVE-2026-56060 - Block unauthenticated invoice access'"
    SecRule &REQUEST_COOKIES:wordpress_logged_in "@eq 0"