LiveActive security incident?Get immediate response
CVE Record

CVE-2026-1906: PDF Invoices & Packing Slips for WooCommerce <= 5.6.0 - Missing Authorization to Authenticated (Subscriber+) Peppol Identifier Modification

The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.6.0 via the `wpo_ips_edi_save_order_customer_peppol_identifiers` AJAX action due to missing capability checks and order ownership validation. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify Peppol/EDI endpoint identifiers (`peppol_endpoint_id`, `peppol_endpoint_eas`) for any customer by specifying an arbitrary `order_id` parameter on systems using Peppol invoicing. This can affect order routing on the Peppol network and may result in payment disruptions and data leakage.

MediumCVSS 4.3Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

A WooCommerce invoicing plugin flaw lets any logged-in WordPress user change Peppol/EDI invoice routing identifiers tied to orders when Peppol invoicing is used. This could misroute invoice data, disrupt payment processing, or expose business information. It is not reported as actively exploited in the provided sources.

Executive priority

Treat as a targeted business-process risk, not a site-takeover issue. Prioritize affected ecommerce sites that use Peppol invoicing or allow customer/subscriber logins, because invoice routing and payment operations may be affected.

Technical view

CVE-2026-1906 is an IDOR/missing authorization issue in PDF Invoices & Packing Slips for WooCommerce through 5.6.0. The vulnerable AJAX action lacks capability checks and order ownership validation, allowing Subscriber-level users or higher to alter Peppol endpoint fields for arbitrary orders.

Likely exposure

Exposure is limited to WordPress/WooCommerce sites using PDF Invoices & Packing Slips for WooCommerce versions up to 5.6.0, especially where Peppol invoicing is enabled and untrusted users can authenticate.

Exploitation context

Attackers need a valid low-privilege WordPress account. The known impact is integrity loss affecting Peppol/EDI identifiers, with possible invoice routing disruption and data leakage. No KEV listing or cited active exploitation evidence is provided.

Researcher notes

The source describes CWE-862 and CVSS 4.3. Evidence identifies missing capability and ownership checks around the named AJAX action. Public sources in the bundle do not provide confirmed exploitation or detailed patch notes, so remediation should follow vendor guidance.

Mitigation direction

  • Identify sites running the affected plugin at version 5.6.0 or earlier.
  • Check the vendor plugin page for the fixed release and upgrade guidance.
  • Restrict or remove unnecessary low-privilege WordPress accounts.
  • Disable Peppol invoicing workflows if not required until remediated.
  • Monitor order metadata changes involving Peppol endpoint identifiers.

Validation and detection

  • Inventory WordPress sites using the plugin.
  • Confirm installed plugin version is newer than 5.6.0 or vendor-confirmed fixed.
  • Review whether Peppol invoicing is enabled.
  • Check audit logs for unexpected Peppol identifier changes.
  • Verify only authorized roles can modify invoice routing data.
Prepared
Confidence
medium
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · medium confidence lookup

CWE-862: Authorization and privilege behavior lookup

Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2026-1906 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Medium
CVSS
4.3 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
4Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
4.3CVSS 3.1MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N2.81.4Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

4.3Medium
CVSS 3.1 vector shape for CVE-2026-1906Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
wpovernightPDF Invoices & Packing Slips for WooCommerce0unaffected
Weakness

CWE details

CWE-862

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-862 · source CWE mapping

Missing Authorization

Missing Authorization represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs