Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-10-10
Print Invoices Packing Slip Labels For Woocommerce - Security Vulnerability (CVE-2026-93746)
The WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.0.2 via the 'email' parameter of the guest print_document_from_the_mail_link handler dispatched from print_window() on init. This is due to the handler authorizing access to an order's printable documents when the attacker-supplied (base64-encoded) 'email' equals the order's billing email — a non-secret identifier — instead of requiring the WooCommerce order_key. This makes it possible for unauthenticated attackers, when the site is configured to…
PLUGIN
Print Invoices Packing Slip Labels For Woocommerce
CVE-2026-93746
Risk Score
Threat Entry
Updated 2026-10-12
Print Invoices Packing Slip Labels For Woocommerce - Path Traversal (CVE-2026-18027)
The WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.9.8 via the get_image_src_in_base64 function. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. The base64-encoded file contents are embedded into the cached invoice HTML and served directly to the attacker via the plugin's own Print/Download invoice endpoints, which require only a valid nonce and…
PLUGIN
Print Invoices Packing Slip Labels For Woocommerce
CVE-2026-18027
Risk Score
Threat Entry
Updated 2026-06-17
Print Invoices Packing Slip Labels For Woocommerce - Broken Access Control (CVE-2024-3216)
The WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wt_pklist_reset_settings() function in all versions up to, and including, 4.4.2. This makes it possible for unauthenticated attackers to reset all of the plugin's settings.
PLUGIN
Print Invoices Packing Slip Labels For Woocommerce
CVE-2024-3216
Risk Score