CVE-2026-18027: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in webtoffee WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels

CVE-2026-18027 is a directory traversal vulnerability (CWE-22) in the WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels plugin for WordPress. Versions up to and including 4.9.8 are affected. The vulnerability exists in the get_image_src_in_base64 function, allowing authenticated attackers with subscriber-level privileges or higher to read arbitrary files on the server. The contents of these files are base64-encoded and embedded into cached invoice HTML, which can be retrieved via the plugin's Print/Download invoice endpoints. These endpoints require a valid nonce and access key but do not restrict file access properly, enabling exposure of sensitive server files.

An attacker with subscriber-level access or higher can read arbitrary files on the server, potentially exposing sensitive information. The vulnerability does not allow modification or deletion of files, nor denial of service, but compromises confidentiality of server data. The attack requires authentication but only low privileges and no user interaction beyond valid nonce and access key.

No official patch or fix information is provided in the vendor advisory or input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict subscriber-level access where possible and monitor for suspicious activity involving invoice download endpoints. Consider disabling or restricting use of the affected plugin if feasible.