What the vulnerability does
01Description
The WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.9.8 via the get_image_src_in_base64 function. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. The base64-encoded file contents are embedded into the cached invoice HTML and served directly to the attacker via the plugin's own Print/Download invoice endpoints, which require only a valid nonce and access key.
Explanation of Vulnerability in Simple Terms
02Summary
The WebToffee WooCommerce PDF Invoices plugin versions 4.9.8 and earlier contain a path traversal vulnerability that allows authenticated users to read arbitrary files from the server. An attacker with low-level access can bypass directory restrictions and access sensitive files outside the intended plugin directory. This could expose database credentials, configuration files, or other confidential data stored on the server.
What an attacker can do
03Attacker Capabilities
Read arbitrary files from the server, including configuration files and sensitive data.
Potential impact on your site
04Site Impact
Sensitive server files and credentials may be exposed to any authenticated user, risking data breach and further compromise.
Conditions required to exploit
05Prerequisites
Attacker must have a low-privilege user account (e.g., customer or subscriber role) on the WordPress site.
Key dates
06Disclosure timeline
August 22, 2026
CVE published
