WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels <= 4.9.4 - Unauthenticated Information Exposure
Description
The WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.9.4. This makes it possible for unauthenticated attackers to extract sensitive user or configuration data.
CVSS Vector Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NTechnical Details
<=4.9.4What Changed in the Fix
Changes introduced in v4.9.5
Source Code
WordPress.org SVN# Vulnerability Research Plan: CVE-2026-49056 ## 1. Vulnerability Summary The **WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels** plugin (up to 4.9.4) is vulnerable to **Unauthenticated Information Exposure**. The vulnerability exists because the plugin enqueues …
Show full research plan
Vulnerability Research Plan: CVE-2026-49056
1. Vulnerability Summary
The WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels plugin (up to 4.9.4) is vulnerable to Unauthenticated Information Exposure. The vulnerability exists because the plugin enqueues admin-side scripts and their localized data on frontend pages (or via hooks accessible to unauthenticated users). Specifically, the Wf_Woocommerce_Packing_List_Admin::enqueue_scripts() method populates a JavaScript object wf_pklist_params with a complete list of database meta keys fetched via self::order_meta_dropdown_list(). This exposes all custom field names (meta keys) from the wp_postmeta table to unauthenticated actors, which can reveal sensitive configuration details, the presence of other plugins, and the structure of internal data.
2. Attack Vector Analysis
- Endpoint: Any public-facing WordPress page where the plugin enqueues its scripts (e.g., the Homepage, Login page, or WooCommerce "Order Received" page).
- Vulnerable Variable: The global JavaScript object
wf_pklist_paramsembedded in the HTML source code. - Preconditions:
- The plugin must be active.
- At least one order or product should exist in the database (to provide meta keys).
- Authentication: None required (Unauthenticated).
3. Code Flow
- **
Summary
The plugin exposes internal database structure and configuration details to unauthenticated users by enqueuing administrative scripts on public-facing pages. These scripts include localized JavaScript objects containing a comprehensive list of all order and product metadata keys (custom fields) stored in the WordPress database.
Vulnerable Code
// admin/class-wf-woocommerce-packing-list-admin.php line 110 $order_meta_autocomplete = self::order_meta_dropdown_list(); $product_meta_autocomplete = self::product_meta_dropdown_list(); $wf_admin_img_path=WF_PKLIST_PLUGIN_URL . 'admin/images/uploader_sample_img.png'; $is_rtl = is_rtl() ? 'rtl' : 'ltr'; $user_id = get_current_user_id(); $dont_show_again = false; if(0 !== $user_id){ if(1 == get_user_meta($user_id, 'wt_pklist_doc_create_dont_show_popup',true) || "1" === get_user_meta($user_id, 'wt_pklist_doc_create_dont_show_popup',true)){ $dont_show_again = true; } } $wt_pklist_plugin_data = $this->get_wt_pklist_plugin_data(); $params=array( 'nonces' => array( 'wf_packlist' => wp_create_nonce(WF_PKLIST_PLUGIN_NAME), ), 'newsletter_banner_nonce' => wp_create_nonce('wt_newsletter_banner_nonce'), 'ajaxurl' => admin_url('admin-ajax.php'), 'no_image'=>$wf_admin_img_path, 'bulk_actions'=>array_keys($this->bulk_actions), 'print_action_url'=>admin_url('?print_packinglist=true'), 'order_meta_autocomplete' => json_encode($order_meta_autocomplete), 'product_meta_autocomplete' => json_encode($product_meta_autocomplete), --- // admin/class-wf-woocommerce-packing-list-admin.php line 171 wp_localize_script($this->plugin_name, 'wf_pklist_params', $params);
Security Fix
@@ -107,13 +107,13 @@ // order list page bulk action filter $this->bulk_actions = apply_filters( 'wt_print_bulk_actions', $this->bulk_actions ); - $order_meta_autocomplete = self::order_meta_dropdown_list(); - $product_meta_autocomplete = self::product_meta_dropdown_list(); + $order_meta_autocomplete = current_user_can( 'manage_woocommerce' ) ? self::order_meta_dropdown_list() : array(); + $product_meta_autocomplete = current_user_can( 'manage_woocommerce' ) ? self::product_meta_dropdown_list() : array(); $wf_admin_img_path = WF_PKLIST_PLUGIN_URL . 'admin/images/uploader_sample_img.png';
Exploit Outline
1. Access any frontend page of a WordPress site running the vulnerable plugin (e.g., the homepage or a product page). 2. Open the browser's Developer Tools (Console) or view the page source. 3. Search for the global JavaScript variable `wf_pklist_params`. 4. Inspect the contents of `wf_pklist_params.order_meta_autocomplete` and `wf_pklist_params.product_meta_autocomplete`. 5. The attacker can now view every custom field (meta key) name used in the site's database for orders and products, which can expose the use of specific third-party plugins or internal business logic/data structures without any authentication.
Check if your site is affected.
Run a free security audit to detect vulnerable plugins, outdated versions, and misconfigurations.