CVE-2026-13116 describes an Insecure Direct Object Reference vulnerability (CWE-639) in the PDF Invoices & Packing Slips for WooCommerce plugin for WordPress, affecting all versions up to and including 5.14.0. The vulnerability arises from missing validation on a user-controlled key parameter in the generate_document_shortcode, allowing authenticated attackers with contributor-level or higher privileges to create session-free download links for arbitrary third-party orders. This can expose customer personal and order details such as names, addresses, emails, phone numbers, order and invoice numbers, line items, totals, payment details, and customer notes. Exploitation requires the plugin's Document link access type setting to be configured to 'full'; if set to the default 'logged_in', URLs are signed with a per-session nonce, preventing unauthorized access via this vector.

An attacker with contributor-level or higher access can generate publicly accessible download links for invoices and packing slips of arbitrary third-party orders, exposing sensitive customer and order information without requiring session authentication. This compromises customer privacy and order confidentiality. The impact is limited by the plugin configuration; if the Document link access type is set to 'logged_in' (default), exploitation is not feasible via this method.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, ensure the plugin's Document link access type setting remains at the default 'logged_in' value to prevent unauthorized access. Avoid setting this option to 'full' to mitigate the vulnerability.