CVE-2026-49056: WordPress WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels plugin <= 4.9.4 - Sensitive Data Exposure vulnerability

Synopsis

This is an unauthenticated sensitive data exposure vulnerability in the WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels plugin by WebToffee, affecting version 4.9.4 and earlier. The flaw is reachable over the network with no authentication required and no user interaction needed. Successful exploitation gives an attacker direct read access to sensitive data handled by the plugin, such as order details, customer information, and shipping records. No fix version has been published yet; HarborGuard tracks the advisory and will make a patched-image rebuild available the moment an upstream fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable plugin endpoint is exposed over the network, meaning an attacker only needs HTTP/HTTPS access to the WordPress site to reach it.

• AuthenticationNot required

  No account or session credential of any kind is needed; the attacker can trigger the exposure as a completely anonymous visitor.

• Victim interactionNot required

  No user action is required on the target site; the attacker sends requests directly without involving any authenticated user.

• Attack complexityDetail

  Exploitation is straightforward and condition-free, requiring no race conditions, special configurations, or environmental factors to succeed reliably.

Blast Radius

• Reads order-related documents including PDF invoices, packing slips, delivery notes, and shipping labels generated by the plugin.
• Exposes customer personally identifiable information (PII) such as billing names, addresses, and order details embedded in those documents.
• Allows an unauthenticated attacker to enumerate or harvest business-sensitive shipping and fulfillment data without leaving obvious authentication traces.