PDF Invoices & Packing Slips for WooCommerce <= 5.6.0 - Missing Authorization to Authenticated (Subscriber+) Peppol Identifier Modification

This research plan outlines the steps to exploit CVE-2026-1906, a Missing Authorization vulnerability in the PDF Invoices & Packing Slips for WooCommerce plugin.

1. Vulnerability Summary

The plugin provides an AJAX action wpo_ips_edi_save_order_customer_peppol_identifiers intended to save Peppol/EDI identifiers (Electronic Address Scheme and Endpoint ID) for an order. The vulnerability exists because the handler for this AJAX action fails to perform capability checks (e.g., current_user_can( 'manage_options' )) or validate that the user making the request is the owner of the order. This allows any authenticated user (Subscriber level and above) to modify the Peppol routing information for any order and its associated customer.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Action: wpo_ips_edi_save_order_customer_peppol_identifiers
• Method: POST
• Required Role: Subscriber or higher
• Vulnerable Parameters:
  • order_id: The target WooCommerce order ID to modify.
  • peppol_endpoint_id: The new Peppol identifier (e.g., 0088:123456789).
  • peppol_endpoint_eas: The Electronic Address Scheme code (e.g., 0088).
• Preconditions:
  • The plugin must have EDI/Peppol functionality enabled.
  • An electronic invoice format (like ubl_peppol_30) must be selected in settings.

3. Code Flow

1. Registration: In includes/Admin.php, the action is registered:
   add_action( 'wp_ajax_wpo_ips_edi_save_order_customer_peppol_identifiers', array( $this, 'ajax_edi_save_order_customer_peppol_identifiers' ) );
2. Entry Point: A POST request to admin-ajax.php with action=wpo_ips_edi_save_order_customer_peppol_identifiers triggers the ajax_edi_save_order_customer_peppol_identifiers method.
3. Processing: The handler extracts order_id, peppol_endpoint_id, and peppol_endpoint_eas from $_POST.
4. Vulnerable Sink: It calls wpo_ips_edi_maybe_save_order_peppol_data() (found in wpo-ips-functions-edi.php) or similar internal logic.
5. Persistence:
   • _peppol_endpoint_id and _peppol_endpoint_eas are updated in the order's meta data (WC_Order::update_meta_data).
   • If the order has an associated customer ID, the user meta keys peppol_endpoint_id and peppol_endpoint_eas are updated for that user.
6. Authorization Failure: No check is made to ensure the user has administrative privileges or that get_current_user_id() == $order->get_customer_id().

4. Nonce Acquisition Strategy

The plugin enqueues the required scripts and nonces on pages where Peppol fields are present, such as the Checkout page or the My Account address edit page.

1. Setup: Create a page with the WooCommerce Checkout shortcode.
2. Action: Navigate to the Checkout page as the Attacker (Subscriber).
3. Extraction: Use browser_eval to find the localized nonce. The plugin typically localizes these under an object named wpo_ips_edi or wpo_wcpdf_admin.
4. Target Variable: Based on standard plugin patterns, look for:
   • window.wpo_ips_edi?.nonce
   • window.wpo_wcpdf_admin?.nonce
   • Or specifically for this action: window.wpo_ips_edi?.save_peppol_nonce

Note: If no specific nonce is found, the handler may be using a generic nonce or potentially skipping verification if check_ajax_referer is omitted.

5. Exploitation Strategy

1. Identify Target: Determine the order_id of a victim's order (e.g., via simple enumeration if IDOR is possible elsewhere, or by creating a test order as an Admin).
2. Prepare Payload:
   • action: wpo_ips_edi_save_order_customer_peppol_identifiers
   • order_id: [VICTIM_ORDER_ID]
   • peppol_endpoint_id: 0088:attacker-controlled-id
   • peppol_endpoint_eas: 0088
   • security: [EXTRACTED_NONCE]
3. Execute Request: Send the payload via the http_request tool.

POST /wp-admin/admin-ajax.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded

action=wpo_ips_edi_save_order_customer_peppol_identifiers&order_id=123&peppol_endpoint_id=0088:999999999&peppol_endpoint_eas=0088&security=a1b2c3d4e5

6. Test Data Setup

1. Enable EDI:

   wp option update wpo_ips_edi_settings '{"enabled":"1","format":"ubl_peppol_30"}' --format=json
   

2. Create Victim: Create an Admin user and a "Victim Order".

   wp user create victim victim@example.com --role=administrator --user_pass=password
   wp wc order create --customer_id=$(wp user get victim --field=ID) --status=completed
   # Note the returned Order ID (e.g., 123)
   

3. Create Attacker:

   wp user create attacker attacker@example.com --role=subscriber --user_pass=password
   

4. Prepare Checkout: Ensure a page with [woocommerce_checkout] exists to find nonces.

7. Expected Results

• The server should return a success status (often wp_send_json_success returns {"success":true}).
• The _peppol_endpoint_id meta value for Order 123 should change to the attacker-supplied value.
• The peppol_endpoint_id user meta for the Victim user should also change.

8. Verification Steps

1. Check Order Meta:

   wp post primary-generate-peppol-meta 123 --meta_key=_peppol_endpoint_id
   # Or using standard wp post meta:
   wp post meta get 123 _peppol_endpoint_id
   

2. Check User Meta:

   wp user meta get $(wp user get victim --field=ID) peppol_endpoint_id
   

9. Alternative Approaches

If the order_id is validated but the user meta is still updated, focus on the user-level IDOR. If check_ajax_referer fails, try checking if the nonce is enqueued on the wp-admin dashboard for all logged-in users, as Subscribers can access the dashboard in default WooCommerce configurations.