CVE-2026-109217

The record

The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.16.5 via the 'invoice_number (via document filename)' parameter. This makes it possible for unauthenticated attackers to extract another customer's complete invoice PDF — including billing identity, shipping address, private order notes, line items, prices, dates, order ID, and invoice number — delivered directly to the attacker's email as an order confirmation attachment. Exploitation requires the plugin's yearly invoice number reset option to be enabled, and the attacker's guest-checkout order must trigger a processing email within 60 seconds of a victim order that shares the same yearly-reset invoice number.

Affected packages

Related vulnerabilities

• CVE-2026-115710 Use of Cache Containing Sensitive Information (CWE-524) in Elasticsearch can lead to… CWE-524
• CVE-2026-113593 An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before… CWE-524
• CVE-2026-118489 In Eclipse Vert.x versions [4.0.0,4.5.35] or [5.0.0,5.2.2], when one `CachingWebClient`… CWE-524
• CVE-2026-111464 The WP Fastest Cache plugin for WordPress is vulnerable to Sensitive Information Exposure… CWE-524
• CVE-2026-105711 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.0 before… CWE-524
• CVE-2026-108088 ** UNSUPPORTED WHEN ASSIGNED ** Use of cache containing sensitive information… CWE-524
• CVE-2026-85317 Use of Cache Containing Sensitive Information vulnerability in Apache Camel HTTP… CWE-524
• CVE-2026-109829 undici is an HTTP client library for Node.js. CWE-524