Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-18027: WebToffee WooCommerce plugin lets logged-in users read any server file

CVE-2026-18027 · published 2 months ago

Summary

The PDF invoice plugin for WooCommerce can be tricked into opening any file on your web server when a user with a basic account logs in. The file’s contents are then returned in the invoice download response, exposing potentially private data. Update the plugin to the latest version or remove it if you do not need the feature.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
webtoffee	webtoffee woocommerce pdf invoices, packing slips, delivery notes & shipping labels	<= 4.9.8

Original advisory text

The WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.9.8 via the get_image_src_in_base64 function. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. The base64-encoded file contents are embedded into the cached invoice HTML and served directly to the attacker via the plugin's own Print/Download invoice endpoints, which require only a valid nonce and access key.

References

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

6.5 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-22Path Traversal

Timeline

Published23 Aug 2026

Updated4 Nov 2026

First seen22 Aug 2026

Sources

CVE-2026-18027 · NVD

CVE-2026-18027 · MITRE

Track software like this

Free during beta