CVE-2026-93746: CWE-639 Authorization Bypass Through User-Controlled Key in webtoffee WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels

CVE-2026-93746 is an Insecure Direct Object Reference vulnerability (CWE-639) in the WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels plugin for WordPress, affecting versions up to and including 5.0.2. The vulnerability exists in the 'email' parameter of the guest print_document_from_the_mail_link handler, which is dispatched from print_window() on init. The handler authorizes access to order documents if the base64-encoded 'email' parameter matches the order's billing email, a non-secret identifier, instead of requiring the WooCommerce order_key. When the site is configured to allow guest access to documents (wt_pklist_print_button_access_for not set to 'logged_in'), unauthenticated attackers can retrieve any customer's invoices, packing slips, delivery notes, dispatch labels, or shipping labels by knowing the order ID and billing email.

An attacker can access sensitive customer information including names, billing and shipping addresses, phone numbers, purchased products, prices, taxes, and invoice metadata without authentication. This compromises customer privacy and could lead to further targeted attacks or fraud. The vulnerability does not allow modification or deletion of data, only unauthorized read access to order documents.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to disable guest access to printable documents by setting 'wt_pklist_print_button_access_for' to 'logged_in' to prevent unauthorized access. Monitor vendor channels for updates and apply patches promptly once released.