The vulnerability is a directory traversal flaw in the get_image_src_in_base64 function of the WebToffee WooCommerce PDF Invoices plugin. An authenticated user with subscriber-level or higher access can supply a specially crafted customer_note parameter that causes the plugin to read any file on the server. The plugin then base‑encodes the file contents, embeds them into a cached invoice page and serves the page through its Print/Download endpoints, which only require a valid nonce and access key. This allows the attacker to read arbitrary files containing sensitive data, resulting in a confidentiality breach.

All installations of the WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels plugin for WordPress up to and including version 4.9.8 are affected. The issue exists in the core plugin code referenced in the source paths. No other product versions are listed.

The CVSS score of 6.5 indicates a moderate severity. Exploitation requires the attacker to have authenticated subscriber-level credentials and to be able to supply a nonce and access key for the invoice endpoints. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Because the attacker can read arbitrary files, the impact could be significant if sensitive files are accessed, but the lack of a publicly available exploit reduces immediate risk. Monitoring access and patching remains prudent.