This vulnerability (CVE-2026-49056) affects versions of the WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels plugin up to and including 4.9.4. It permits unauthenticated attackers to access sensitive data without authorization, violating confidentiality. The CVSS 3.1 base score is 7.5, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact. The vulnerability is categorized as CWE-497, indicating exposure of sensitive system information to unauthorized entities. No patch or official remediation level has been published as of the data provided.

Successful exploitation results in unauthorized disclosure of sensitive system information, potentially leading to further attacks or information leakage. The impact is limited to confidentiality; integrity and availability are not affected. The vulnerability can be exploited remotely without authentication or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected plugin functionality where possible and monitor for updates from the vendor. Avoid exposing the plugin to untrusted networks or users.