[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fop5A4uHOGlxzos7RdzC7MXZGVpXovhhreTfN9fsyA9Q":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":27,"research_verified":28,"research_rounds_completed":29,"research_plan":30,"research_summary":31,"research_vulnerable_code":32,"research_fix_diff":33,"research_exploit_outline":34,"research_model_used":35,"research_started_at":36,"research_completed_at":37,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":28,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":28,"source_links":38},"CVE-2026-49056","webtoffee-woocommerce-pdf-invoices-packing-slips-delivery-notes-shipping-labels-unauthenticated-information-exposure","WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels \u003C= 4.9.4 - Unauthenticated Information Exposure","The WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.9.4. This makes it possible for unauthenticated attackers to extract sensitive user or configuration data.","print-invoices-packing-slip-labels-for-woocommerce",null,"\u003C=4.9.4","4.9.5","medium",5.3,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:L\u002FI:N\u002FA:N","Exposure of Sensitive Information to an Unauthorized Actor","2026-06-03 00:00:00","2026-06-11 13:25:15",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F8bb34d74-4d13-4e7a-b78d-5691eb778401?source=api-prod",9,[22,23,24,25,26],"admin\u002Fclass-wf-woocommerce-packing-list-admin.php","admin\u002Fcss\u002Fwf-woocommerce-packing-list-admin.css","admin\u002Fjs\u002Fwf-woocommerce-packing-list-admin.js","admin\u002Fmodules\u002Fcross-promotion-banners\u002Fclass-wbte-accessibility-banner.php","admin\u002Fmodules\u002Fcustomizer\u002Fclasses\u002Fclass-customizer.php","researched",false,3,"# Vulnerability Research Plan: CVE-2026-49056\n\n## 1. Vulnerability Summary\nThe **WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels** plugin (up to 4.9.4) is vulnerable to **Unauthenticated Information Exposure**. The vulnerability exists because the plugin enqueues admin-side scripts and their localized data on frontend pages (or via hooks accessible to unauthenticated users). Specifically, the `Wf_Woocommerce_Packing_List_Admin::enqueue_scripts()` method populates a JavaScript object `wf_pklist_params` with a complete list of database meta keys fetched via `self::order_meta_dropdown_list()`. This exposes all custom field names (meta keys) from the `wp_postmeta` table to unauthenticated actors, which can reveal sensitive configuration details, the presence of other plugins, and the structure of internal data.\n\n## 2. Attack Vector Analysis\n- **Endpoint**: Any public-facing WordPress page where the plugin enqueues its scripts (e.g., the Homepage, Login page, or WooCommerce \"Order Received\" page).\n- **Vulnerable Variable**: The global JavaScript object `wf_pklist_params` embedded in the HTML source code.\n- **Preconditions**:\n    - The plugin must be active.\n    - At least one order or product should exist in the database (to provide meta keys).\n- **Authentication**: None required (**Unauthenticated**).\n\n## 3. Code Flow\n1.  **","The plugin exposes internal database structure and configuration details to unauthenticated users by enqueuing administrative scripts on public-facing pages. These scripts include localized JavaScript objects containing a comprehensive list of all order and product metadata keys (custom fields) stored in the WordPress database.","\u002F\u002F admin\u002Fclass-wf-woocommerce-packing-list-admin.php line 110\n\t\t$order_meta_autocomplete = self::order_meta_dropdown_list();\n\t\t$product_meta_autocomplete = self::product_meta_dropdown_list();\n\t\t$wf_admin_img_path=WF_PKLIST_PLUGIN_URL . 'admin\u002Fimages\u002Fuploader_sample_img.png';\n\t\t$is_rtl = is_rtl() ? 'rtl' : 'ltr';\n\t\t$user_id = get_current_user_id();\n\t\t$dont_show_again = false;\n\t\tif(0 !== $user_id){\n\t\t\tif(1 == get_user_meta($user_id, 'wt_pklist_doc_create_dont_show_popup',true) || \"1\" === get_user_meta($user_id, 'wt_pklist_doc_create_dont_show_popup',true)){\n\t\t\t\t$dont_show_again = true;\n\t\t\t}\n\t\t}\n\t\t$wt_pklist_plugin_data = $this->get_wt_pklist_plugin_data();\n\t\t$params=array(\n\t\t\t'nonces' => array(\n\t\t            'wf_packlist' => wp_create_nonce(WF_PKLIST_PLUGIN_NAME),\n\t\t     ),\n\t\t\t'newsletter_banner_nonce' => wp_create_nonce('wt_newsletter_banner_nonce'),\n\t\t\t'ajaxurl' => admin_url('admin-ajax.php'),\n\t\t\t'no_image'=>$wf_admin_img_path,\n\t\t\t'bulk_actions'=>array_keys($this->bulk_actions),\n\t\t\t'print_action_url'=>admin_url('?print_packinglist=true'),\n\t\t\t'order_meta_autocomplete' => json_encode($order_meta_autocomplete),\n\t\t\t'product_meta_autocomplete' => json_encode($product_meta_autocomplete),\n---\n\u002F\u002F admin\u002Fclass-wf-woocommerce-packing-list-admin.php line 171\n\t\twp_localize_script($this->plugin_name, 'wf_pklist_params', $params);","--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fprint-invoices-packing-slip-labels-for-woocommerce\u002F4.9.4\u002Fadmin\u002Fclass-wf-woocommerce-packing-list-admin.php\t2026-04-14 05:35:26.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fprint-invoices-packing-slip-labels-for-woocommerce\u002F4.9.5\u002Fadmin\u002Fclass-wf-woocommerce-packing-list-admin.php\t2026-05-26 10:35:34.000000000 +0000\n@@ -107,13 +107,13 @@\n \t\t\u002F\u002F order list page bulk action filter\n \t\t$this->bulk_actions = apply_filters( 'wt_print_bulk_actions', $this->bulk_actions );\n \n-\t\t$order_meta_autocomplete   = self::order_meta_dropdown_list();\n-\t\t$product_meta_autocomplete = self::product_meta_dropdown_list();\n+\t\t$order_meta_autocomplete   = current_user_can( 'manage_woocommerce' ) ? self::order_meta_dropdown_list() : array();\n+\t\t$product_meta_autocomplete = current_user_can( 'manage_woocommerce' ) ? self::product_meta_dropdown_list() : array();\n \t\t$wf_admin_img_path         = WF_PKLIST_PLUGIN_URL . 'admin\u002Fimages\u002Fuploader_sample_img.png';","1. Access any frontend page of a WordPress site running the vulnerable plugin (e.g., the homepage or a product page).\n2. Open the browser's Developer Tools (Console) or view the page source.\n3. Search for the global JavaScript variable `wf_pklist_params`.\n4. Inspect the contents of `wf_pklist_params.order_meta_autocomplete` and `wf_pklist_params.product_meta_autocomplete`.\n5. The attacker can now view every custom field (meta key) name used in the site's database for orders and products, which can expose the use of specific third-party plugins or internal business logic\u002Fdata structures without any authentication.","gemini-3-flash-preview","2026-06-26 05:26:24","2026-06-26 05:27:57",{"type":39,"vulnerable_version":40,"fixed_version":11,"vulnerable_browse":41,"vulnerable_zip":42,"fixed_browse":43,"fixed_zip":44,"all_tags":45},"plugin","4.9.4","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fprint-invoices-packing-slip-labels-for-woocommerce\u002Ftags\u002F4.9.4","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fprint-invoices-packing-slip-labels-for-woocommerce.4.9.4.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fprint-invoices-packing-slip-labels-for-woocommerce\u002Ftags\u002F4.9.5","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fprint-invoices-packing-slip-labels-for-woocommerce.4.9.5.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fprint-invoices-packing-slip-labels-for-woocommerce\u002Ftags"]