WebToffee PDF Invoices Vulnerability Exposes Server Files

Table of Contents

A vulnerability in WebToffee WooCommerce PDF Invoices can allow Subscriber-level users to read sensitive server files through generated invoices. Stores running version 4.9.8 or earlier should update immediately and review recent invoices, customer notes, and unusual Print or Download activity.

---

What Is CVE-2026-18027?

CVE-2026-18027 is an authenticated arbitrary file read vulnerability affecting WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels through version 4.9.8. The flaw carries a CVSS score of 6.5 and can be exploited by an authenticated user with Subscriber-level access. According to Wordfence Intelligence, an attacker can manipulate the customer_note parameter by supplying a server file path. When the vulnerable plugin processes the invoice, it can read that local file and include its contents in Base64-encoded form inside the generated document. The attacker can then retrieve the resulting invoice through the plugin’s Print or Download functionality. This turns a field intended for normal customer information into a potential path for reading files accessible to the PHP process. With more than 50,000 active installations, the vulnerability deserves immediate attention, especially on WooCommerce stores that allow visitors to create accounts.

---

Why Arbitrary File Reading Is Dangerous for WooCommerce

The main concern is not simply that an attacker can access an invoice. Depending on server permissions and configuration, successful exploitation could expose sensitive WordPress or hosting files. A particularly serious target is wp-config.php, because it commonly contains WordPress database credentials, authentication salts, database prefixes, and other environment-specific configuration. Exposure of these details can create additional opportunities for compromise even when the vulnerability itself does not directly provide administrator privileges or remote code execution. Stores with public customer registration face greater practical risk because an attacker may be able to create the low-privileged account needed to reach the vulnerable functionality. Administrators should therefore treat CVE-2026-18027 as a significant information-disclosure issue rather than dismissing it because authentication is required.

---

Which WebToffee PDF Invoices Versions Are Vulnerable?

WebToffee PDF Invoices installations running version 4.9.8 or earlier should be considered affected based on the published vulnerability information. Store owners should update to version 5.0.0 or newer immediately. At the time of this alert, 5.0.1 is the current release listed for the plugin. Before updating a production WooCommerce store, create a reliable backup and confirm that the backup can be restored. After installing the patched version, clear relevant WordPress, object, page, and CDN caches where applicable. Then test normal invoice generation, PDF downloads, order emails, packing slips, and other WebToffee functionality used by the store. Updating closes the known vulnerable path, but it does not determine whether exploitation occurred before the patch was installed.

---

How the customer_note Parameter Can Expose Server Files

The vulnerable workflow involves the customer_note value supplied during invoice-related processing. Instead of safely restricting the input to ordinary customer-note content, affected versions can allow a file path to influence what the plugin reads. The contents of the targeted file may subsequently become Base64 encoded within the generated invoice, allowing the information to be recovered after downloading the resulting document through plugin endpoints. Base64 encoding should not be confused with encryption. Anyone who obtains the encoded data can normally decode it back into its original form. This means configuration files, credentials, API-related secrets, or other readable local data could become exposed if the PHP process has permission to access them. The exact information available to an attacker depends heavily on the server configuration and filesystem permissions.

---

What WooCommerce Administrators Should Check

After updating, review activity from the period when the vulnerable plugin version was active. Inspect recently generated invoices and unusual customer notes, particularly values that resemble filesystem paths or references to WordPress configuration files. Review web server and security logs for suspicious requests involving the plugin’s Print or Download endpoints, unexpected bursts of invoice generation, unfamiliar Subscriber accounts, and requests associated with unusual orders. If evidence suggests that wp-config.php or another credential-bearing file may have been exposed, changing only the plugin version is not enough. Rotate the WordPress database password and update the corresponding value in wp-config.php. Replace the WordPress authentication keys and salts, review administrator accounts and active sessions, and rotate other credentials or secrets that could reasonably have appeared in exposed files. Keep a backup of relevant logs before deleting or rotating evidence that could help an investigation.

---

Frequently Asked Questions

What is CVE-2026-18027?

CVE-2026-18027 is an authenticated arbitrary file read vulnerability reported in WebToffee WooCommerce PDF Invoices through version 4.9.8. It can allow a Subscriber-level user to cause accessible local file contents to appear in generated invoice data.

Does an attacker need administrator access?

No. The reported vulnerability requires an authenticated account, but Subscriber-level privileges can be sufficient. This makes WooCommerce sites with open account registration particularly important to review.

Can the vulnerability expose wp-config.php?

Potentially. Files that are readable by the PHP process may be exposed, depending on the hosting environment and permissions. wp-config.php is especially sensitive because it normally contains database credentials and WordPress authentication configuration.

Is Base64 encoding secure?

No. Base64 is an encoding format, not encryption. Encoded content can easily be converted back into readable data.

Which versions should I update?

Sites running WebToffee PDF Invoices 4.9.8 or earlier should update immediately to 5.0.0 or newer. Version 5.0.1 is the current release referenced in this alert.

Is updating enough after possible exploitation?

Not necessarily. Updating removes the known vulnerable behavior, but previously exposed credentials remain compromised until they are changed. Investigate logs and rotate sensitive credentials if exposure is suspected.

What should I check after installing the patched version?

Review recent invoices, customer notes, newly created Subscriber accounts, server logs, and suspicious Print or Download requests. Also verify that normal invoice generation continues to work correctly after updating.

Should I change my database password?

Do so if you have evidence or a reasonable suspicion that wp-config.php was exposed. Remember to update the database password in both the database service and the WordPress configuration.

---

Protect Your Store Before the Risk Grows

CVE-2026-18027 demonstrates why vulnerabilities involving low-privileged WordPress accounts can still have serious consequences. A Subscriber account may appear harmless, but vulnerable plugin functionality can transform that limited access into a route for obtaining sensitive server information. WooCommerce administrators using WebToffee PDF Invoices should confirm their installed version now, upgrade to 5.0.0 or later, and examine recent invoice activity rather than assuming the update alone resolves previous exposure. Stores that permit public registration deserve additional scrutiny. If logs indicate suspicious file paths, unusual invoice downloads, or attempts to access configuration information, treat potentially exposed credentials as compromised and rotate them promptly.

---

---

Sources and References

Wordfence Intelligence: CVE-2026-18027 vulnerability record covering the authenticated Subscriber-level arbitrary file read issue in WebToffee WooCommerce PDF Invoices 4.9.8 and earlier.

WordPress.org: Official WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels plugin listing for current release information, installation details, and updates.

Secondary Sources and Testimonials

For vulnerability verification, prioritize the security advisory, the official WordPress.org plugin listing, vendor release information, and established vulnerability databases. Community reports can provide useful operational context, but they should not replace primary technical sources when deciding whether a WooCommerce installation is affected.