CVE-2026-93746

Published 10 October 2026 · tracked since 10 October 2026

Description

The WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.0.2 via the 'email' parameter of the guest print_document_from_the_mail_link handler dispatched from prin

References

• NVD — National Vulnerability Database
• CVE.org record (MITRE)
• CISA Known Exploited Vulnerabilities catalog

Latest tracked vulnerabilities

• CVE-2026-105885 HIGH 8.8
• CVE-2026-91136 HIGH 7.5
• CVE-2026-96662 HIGH 7.5
• CVE-2026-93945 CRITICAL 9.8
• CVE-2026-93936 CRITICAL 9.8
• CVE-2026-93937 CRITICAL 9.8
• CVE-2026-93938 CRITICAL 9.8
• CVE-2026-93940 CRITICAL 9.8
• CVE-2026-93941 CRITICAL 9.8
• CVE-2026-93942 CRITICAL 9.8

→ Open the live CVE board · all tools