CVE-2026-18027: WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels <= 4.9.8 - Authenticated (Subscriber+) Arbitrary File Read via 'customer_note' Parameter
The WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.9.8 via the getimagesrcinbase64 function. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. The base64-encoded file contents are embedded into the cached invoice HTML and served directly to the attacker via the plugin's own Print/Download invoice endpoints, which require only a valid nonce and access key.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labelsto a version that resolves this vulnerability.Fixed in 4.9.8 - Compensating control
Restrict access to the plugin’s Print/Download invoice endpoints (that require only a valid nonce and access key) to trusted users/roles at the application level and/or via network access controls until the vulnerable version is fully remediated.
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs an authenticated WordPress account with at least subscriber-level access. No user interaction is required.
What information could be exposed?
The vulnerability allows reading arbitrary files from the server through directory traversal. Exposed files may contain sensitive information, and their contents are base64-encoded into cached invoice HTML.
How is the file content retrieved after exploitation?
The attacker can retrieve the cached invoice HTML through the plugin's Print or Download invoice endpoints. Those endpoints require a valid nonce and access key.
Are installations running version 4.9.8 affected?
Yes. The affected range includes all plugin versions up to and including 4.9.8.