CVE-2026-13116 is an insecure direct object reference in PDF Invoices & Packing Slips for WooCommerce through version 5.14.0. When Full document-link access is enabled, missing order-level authorization can allow a low-privileged content author to obtain a public link to another customer’s invoice or packing slip. Exposed documents may contain customer contact information, addresses, purchased items, totals and order notes. The supplied research describes version 5.9.2, while the public advisory identifies 5.15.0 as the first fixed release.
| CVE | CVE-2026-13116 |
| Plugin Version | PDF Invoices & Packing Slips for WooCommerce <= 5.14.0, fixed in 5.15.0 |
| All Time | 24 130 980 |
| Active installations | 300 000+ |
| Publicly Published | July 10, 2026 |
| Last Updated | July 11, 2026 |
| Researcher | Dmitrii Ignatyev |
| CWE | CWE-639 – Authorization Bypass Through User-Controlled Key |
| PoC | Yes |
| Exploit | No |
| Reference | https://www.cve.org/CVERecord?id=CVE-2026-13116 https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/woocommerce-pdf-invoices-packing-slips/pdf-invoices-packing-slips-for-woocommerce-5140-insecure-direct-object-reference-to-authenticated-contributor-sensitive-information-disclosure-via-order-id-shortcode-attribute |
| Plugin Security Certification by CleanTalk |  |
| Logo of the plugin |  |
PSC by CleantalkJoin the community of developers who prioritize security. Highlight your plugin in the WordPress catalog.
Timeline
| April 20, 2026 | Plugin testing and vulnerability detection completed. |
| April 20, 2026 | The vulnerability report, proof of concept and remediation recommendations were sent. |
| July 10, 2026 | CVE-2026-13116 was publicly published in the Wordfence vulnerability database. |
Discovery of the Vulnerability
The supplied report identifies missing authorization in the frontend document-shortcode handlers. In the reported test version, 5.9.2, these paths can load a referenced order and check document availability without first establishing whether the caller owns the order or has permission to manage its documents.
In Full access mode, a generated document URL can grant access independently of the requesting visitor’s session. This makes authorization at link creation essential. The report also notes that document initialization may save metadata or record creation events when the requested document does not yet exist. These possible side effects should be covered by regression tests.
Understanding of IDOR attacks
An insecure direct object reference occurs when a server accepts a reference to a record but fails to verify the caller’s authority over that specific record. Confirming that an order exists or that an invoice is available does not establish permission to disclose its contents.
The public advisory records Contributor-level access and above. The supplied scenario uses an Author account with publication privileges. Permission to write or publish WordPress content must remain separate from permission to access customer orders. Full access is intended for recipients who already possess a legitimately issued document link, so it does not remove the need to authorize creation of that link.
Exploiting the IDOR Vulnerability
The supplied proof of concept describes a document-link authorization failure. The following summary records the security property under review and the reported outcome. This article is based on that report and the public advisory.
POC:
[wcpdf_download_invoice order_id="431" link_text="Download invoice"]____
For regression coverage, developers should compare the behavior for the order owner, an unrelated customer, a content author and authorized store staff. Unauthorized cases must fail before a document link is issued or document metadata is initialized. Use synthetic customer records when verifying these controls.
Recommendations for Improved Security
Update PDF Invoices & Packing Slips for WooCommerce to version 5.15.0 or a newer patched release. Until the update is applied, retain the default Logged in document-link access mode and limit shortcode-bearing content from untrusted accounts. Review existing public content for accidentally exposed invoice or packing-slip links.
Developers should enforce order ownership or an appropriate document-management capability in every document-shortcode path before generating a URL or initializing a document. Document availability checks and knowledge of an order identifier cannot replace object-level authorization. Legitimate guest links should be issued only through an authorized workflow, with the download path enforcing the intended access policy.
Addressing CVE-2026-13116 keeps permission to publish content separate from access to customer order documents. Authorizing each referenced order before creating a link protects both customer privacy and the document-generation workflow.
#WordPressSecurity #IDOR #WooCommerce #AccessControl #WebsiteSafety #StayProtected
Use CleanTalk solutions to improve the security of your website
