PT-2026-20290 · WordPress+1 · Woocommerce Pdf Invoices & Packing Slips+1

Dmitry Ignatyev · Published 2026-02-18 · Updated 2026-02-18 · CVE-2026-1906

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions PDF Invoices & Packing Slips for WooCommerce versions up to and including 5.6.0

Description The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is susceptible to an Insecure Direct Object Reference issue. This is due to missing capability checks and order ownership validation in the wpo ips edi save order customer peppol identifiers AJAX action. Authenticated attackers with Subscriber-level access or higher can modify Peppol/EDI endpoint identifiers (peppol endpoint id, peppol endpoint eas) for any customer by manipulating the order id parameter. This could disrupt order routing on the Peppol network and potentially lead to payment disruptions and data leakage.

Recommendations Versions prior to and including 5.6.0 should be updated.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-1906

Affected Products

Woocommerce Pdf Invoices & Packing Slips

Woocommerce

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2026-1906 · Security Note
• https://plugins.trac.wordpress.org/browser/woocommerce-pdf-invoices-packing-slips/tags/5.6.0/includes/Admin.php#L895 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/2e1922c6-e63b-47aa-97de-1e2382fa25d3?source=cve · Note
• https://twitter.com/VulmonFeeds/status/2024056656670183491 · Twitter Post
• https://t.me/CVEtracker/44934 · Telegram Post
• https://twitter.com/CVEnew/status/2024011997906694640 · Twitter Post
• https://t.me/cveNotify/152286 · Telegram Post
• https://wordpress.org/plugins/woocommerce-pdf-invoices-packing-slips/#developers · Note
• https://plugins.trac.wordpress.org/browser/woocommerce-pdf-invoices-packing-slips/tags/5.6.0/includes/Admin.php#L72 · Note