CVE-2026-11496: Woo PDF Invoice Builder <= 2.0.8 - Authenticated (Subscriber+) Insecure Direct Object Reference to Sensitive Order Information Disclosure
The Woo PDF Invoice Builder plugin (also distributed as "PDF Builder for WooCommerce") for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.8. This is due to the InspectOrder() AJAX handler (woocommerce-pdf-invoice-ajax.php:513), registered on wpajaxrednaowcpdfinvinspectorder, performing no capability check and no nonce verification before loading an arbitrary order by the attacker-supplied 'OrderNumber' POST field and serializing its full WCOrder::getdata() and meta to the response. This makes it possible for authenticated attackers with Subscriber-level access and above to read every WooCommerce order on the site — including billing/shipping address, email, phone number, payment method, gateway transaction ID, and order totals — by iterating order IDs.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs an authenticated WordPress account with at least Subscriber-level access. The vulnerable AJAX handler does not require a WooCommerce-specific capability or a nonce.
What information can be exposed?
An attacker can retrieve full WooCommerce order data and metadata for arbitrary order IDs. This can include billing and shipping addresses, email addresses, phone numbers, payment method details, gateway transaction IDs, and order totals.
Does exploitation require interaction from an order customer or administrator?
No. A low-privileged authenticated user can submit order IDs to the affected AJAX handler and enumerate orders without customer or administrator interaction.
How can I determine whether data may have been exposed?
Review access and application logs for authenticated requests to the rednao_wcpdfinv_inspect_order AJAX action, particularly requests with varying OrderNumber POST values. Repeated or sequential order-number requests from Subscriber-level or otherwise low-privileged accounts are a strong indicator of attempted enumeration.
What can be done if updating is not immediately possible?
Restrict or remove unnecessary low-privileged WordPress accounts, especially Subscriber accounts that do not need access, to reduce exposure. The issue affects plugin versions through 2.0.8, so affected installations should also limit access to the vulnerable AJAX functionality until an update is available.