CVE-2026-11496 is an insecure direct object reference vulnerability in the Woo PDF Invoice Builder plugin for WooCommerce (versions <= 2.0.8). The InspectOrder() AJAX handler (located in woocommerce-pdf-invoice-ajax.php at line 513) is registered on the wp_ajax_rednao_wcpdfinv_inspect_order hook and does not perform any capability or nonce verification. This allows authenticated users with Subscriber-level privileges or higher to supply arbitrary order IDs via the 'OrderNumber' POST parameter and receive serialized order data including sensitive customer and transaction details. The vulnerability exposes full WC_Order::get_data() and meta information for any order on the site.

An attacker with minimal authenticated access (Subscriber role or above) can read sensitive customer and order information for all WooCommerce orders on the affected site. This includes personally identifiable information (billing/shipping addresses, emails, phone numbers), payment method details, gateway transaction IDs, and order totals. The vulnerability does not allow modification or deletion of data, but the confidentiality breach can lead to privacy violations and potential further attacks based on exposed data.

No official patch or fix is currently documented for this vulnerability. Users should monitor the vendor's advisory channels for updates. Until a fix is available, restrict user roles to trusted individuals only and consider disabling or restricting access to the affected AJAX handler if possible. Implementing custom capability checks or nonce verification on the InspectOrder() AJAX handler can mitigate the issue. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.