CVE-2026-18027
validatedZero produced an exploit or a check.GHSA-7r74-667v-4q77 ↗EUVD-2026-64606 ↗
description
WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels versions through 4.9.8 are affected by a path-traversal flaw. An authenticated user with subscriber-level access or greater may obtain server file contents through invoice output functions, subject to access to the required invoice request values.
mitigation
Disable or remove the affected plugin where possible, especially on sites that allow untrusted accounts. Until a vendor-fixed release is confirmed, restrict subscriber account creation and limit access to invoice print and download functionality.
outcome
Upstream: a detection for this already ships elsewhere, so we didn't generate a new one. The credit goes to whoever did.
source signals
Public signals that triggered or updated the pipeline. These are inputs for the deltas above.
- 2026-08-22 23:27Zcve.org record for CVE-2026-18027
- 2026-11-09vulncheck_kev: trigger signal, started the run
- 2026-11-09 00:00Z
- 2026-11-09 14:26Z
this entry in the feed
GET /api/v1/feed/CVE-2026-18027
{ "etk_id": "ETK-2026-3964", "cve_id": "CVE-2026-18027", "display_id": "CVE-2026-18027", "ghsa_id": "GHSA-7r74-667v-4q77", "euvd_id": "EUVD-2026-64606", "status": "published", "anchor_state": "anchored", "title": "Path traversal in WebToffee WooCommerce invoice document plugin", "summary": "WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels versions through 4.9.8 are affected by a path-traversal flaw. An authenticated user with subscriber-level access or greater may obtain server file contents through invoice output functions, subject to access to the required invoice request values.", "mitigation": "Disable or remove the affected plugin where possible, especially on sites that allow untrusted accounts. Until a vendor-fixed release is confirmed, restrict subscriber account creation and limit access to invoice print and download functionality.", "vendor": "WebToffee", "product": "woocommerce_pdf_invoices\\,_packing_slips\\,_delivery_notes_and_shipping_labels", "affected": [ { "affected_notes": [], "affected_ranges": [ ">= 0, <= 4.9.8" ], "ecosystem": null, "fixed_versions": [], "package_name": "WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels", "purl": null } ], "cwes": null, "cvss_score": 6.5, "cvss_src": "other", "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "epss_score": 0.0087, "epss_percentile": 0.5899, "epss_asof": "2026-11-09", "automation": "deterministic", "check": true, "check_confidence_basis": "upstream", "exploit": false, "pipeline_minutes": 0.2305038, "t0_at": "2026-08-22T23:27:19.268000+00:00", "signals": { "check": { "at": "2026-11-09T14:26:11.066507+00:00", "days": 78.62421063086805, "is_lower_bound": false, "measured_at": "2026-08-22T23:27:19.268000+00:00", "url": null }, "kev": { "at": "2026-11-09T00:00:00+00:00", "days": 79, "is_lower_bound": false, "measured_at": "2026-08-22T23:27:19.268000+00:00", "precision": "day", "url": "https://vulncheck.com/cve/CVE-2026-18027" }, "trigger_signal": { "at": "2026-11-09T00:00:00+00:00", "days": 78.0226936574074, "is_lower_bound": false, "measured_at": "2026-08-22T23:27:19.268000+00:00", "url": "https://vulncheck.com/cve/CVE-2026-18027" } } }
published 2026-11-09 14:25Z
last change 2026-11-11 06:19Z
Need the technical details behind an entry?
Every entry here shows what we attempted and when. The technical details, the generated exploit that fired it and the evidence behind the verdict are not public. Tell us about your use case and we’ll get back to you about extended API access.