CVE-2026-13116 is an insecure direct object reference vulnerability in the PDF Invoices & Packing Slips for WooCommerce plugin for WordPress. It arises from missing validation on a user-controlled key in the generate_document_shortcode function. Authenticated attackers with contributor-level privileges or higher can exploit this when the plugin's Document link access type is set to 'full', enabling them to create session-free download links to invoices and packing slips of arbitrary third-party orders. This bypasses authorization controls and exposes sensitive customer and order data. The default 'logged_in' setting mitigates this by signing URLs with a per-session nonce, preventing unauthorized access. No official patch or remediation guidance is currently documented.

An attacker with contributor-level or higher access can generate publicly accessible download links for third-party order documents without session validation, exposing sensitive customer information including names, billing and shipping addresses, emails, phone numbers, order and invoice numbers, line items, totals, payment details, and customer notes. This could lead to privacy violations and data leakage. The impact is limited by the requirement that the Document link access type setting be configured to 'full'; the default configuration is not vulnerable.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, ensure that the plugin's Document link access type setting remains at the default 'logged_in' value to prevent unauthorized access. Restrict contributor-level access to trusted users only. Monitor for updates from the vendor and apply patches promptly once released.