---
id: CVE-2026-109217
title: >-
  PDF Invoices & Packing Slips for WooCommerce <= 5.16.5 - Unauthenticated
  Sensitive Information Exposure via Yearly-Reset Invoice Attachment Cache
summary: >-
  The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is
  vulnerable to Sensitive Information Exposure in all versions up to, and
  including, 5.16.5 via the 'invoice_number (via document filename)' parameter.
  This makes it …
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-524
vendor: wpovernight
product: PDF Invoices & Packing Slips for WooCommerce
affected:
  - pdf_invoices_packing_slips_for_woocommerce <= 5.16.5
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-11-05T15:23:25.122661Z'
published: '2026-10-31'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T15:23:38.300Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-109217'
references:
  - url: >-
      https://www.wordfence.com/threat-intel/vulnerabilities/id/e68495ad-53ab-4c6b-aecc-1e4bfe34aa0d?source=cve
  - url: >-
      https://plugins.trac.wordpress.org/browser/woocommerce-pdf-invoices-packing-slips/tags/5.16.4/includes/Main.php#L253
  - url: >-
      https://plugins.trac.wordpress.org/browser/woocommerce-pdf-invoices-packing-slips/tags/5.16.4/includes/Main.php#L239
  - url: >-
      https://plugins.trac.wordpress.org/browser/woocommerce-pdf-invoices-packing-slips/tags/5.16.4/includes/Documents/Invoice.php#L146
  - url: >-
      https://plugins.trac.wordpress.org/browser/woocommerce-pdf-invoices-packing-slips/tags/5.16.4/includes/Main.php#L181
  - url: >-
      https://plugins.trac.wordpress.org/changeset?reponame=&old=3759839%40woocommerce-pdf-invoices-packing-slips&new=3759839%40woocommerce-pdf-invoices-packing-slips
tags:
  - cve.org
epss: 0.00256
epssPercentile: 0.17321
ingestedAt: '2026-11-05T21:36:00.898Z'
---

## Overview

The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.16.5 via the 'invoice_number (via document filename)' parameter. This makes it possible for unauthenticated attackers to extract another customer's complete invoice PDF — including billing identity, shipping address, private order notes, line items, prices, dates, order ID, and invoice number — delivered directly to the attacker's email as an order confirmation attachment. Exploitation requires the plugin's yearly invoice number reset option to be enabled, and the attacker's guest-checkout order must trigger a processing email within 60 seconds of a victim order that shares the same yearly-reset invoice number.

## Affected

- `pdf_invoices_packing_slips_for_woocommerce <= 5.16.5`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.