CVE-2026-49056 Information disclosure in WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels
Unauthenticated attackers can access sensitive data in the WooCommerce PDF Invoices plugin, requiring site administrators to update the plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-49056?
CVE-2026-49056 is a high-severity vulnerability in WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels, published on 15 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Unauthenticated Sensitive Data Exposure in WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels <= 4.9.4 versions.
Weakness: CWE-497
Which versions are affected by CVE-2026-49056?
How do I fix CVE-2026-49056?
No fix has been published for CVE-2026-49056 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-49056 being exploited?
There is no known exploitation of CVE-2026-49056 in the wild and no public exploit code.
Sources
Also known as GHSA-pvhc-cw6m-9mp8.