CVE-2026-11899: PDF Builder for WooCommerce. Create invoices,packing slips and more <= 2.0.11 - Missing Authorization to Authenticated (Subscriber+) Sensitive Invoice Data Disclosure via GetInvoiceDetail AJAX Handler
The PDF Builder for WooCommerce. Create invoices,packing slips and more plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.0.11. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve invoice numbers, formatted invoice numbers, and creation timestamps for arbitrary WooCommerce orders by supplying any OrderNumber and InvoiceId values with a garbage nonce.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs an authenticated WordPress account with at least Subscriber-level access. No user interaction is required, and the vulnerable AJAX handler is reachable over the network.
What information could be exposed?
An attacker can retrieve invoice numbers, formatted invoice numbers, and invoice creation timestamps for arbitrary WooCommerce orders. The provided data does not indicate exposure of invoice contents, customer details, or payment information.
Does a valid nonce prevent exploitation?
No. The issue can be exploited by supplying OrderNumber and InvoiceId values along with a garbage nonce, because the handler does not properly verify authorization.
Which plugin versions are affected?
All versions up to and including 2.0.11 are affected. The provided information does not identify a fixed version.