The PDF Invoices & Packing Slips for WooCommerce plugin contains an insecure direct object reference in the AJAX action wpo_ips_edi_save_order_customer_peppol_identifiers. The code performs no capability checks or order ownership validation, allowing an authenticated user with relatively low privileges to supply any order identifier and modify the peppol_endpoint_id and peppol_endpoint_eas fields. This can reroute invoices to unintended parties, lead to payment delays or losses, and expose confidential customer data. The flaw aligns with the missing authorization weakness (CWE‑862).

All WordPress sites that have installed the PDF Invoices & Packing Slips for WooCommerce plugin version 5.6.0 or earlier are vulnerable. The vulnerability affects any running instance where the Peppol invoicing feature is enabled, regardless of other security configurations. Sites that have upgraded beyond 5.6.0 are not impacted by the known issue.

The CVSS score of 4.3 indicates moderate severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation in the immediate future. The flaw is not listed in CISA’s KEV catalog. Exploitation requires a legitimate user account with at least Subscriber permissions and the ability to call the affected AJAX endpoint with a crafted order ID. Successful manipulation could alter invoice routing on the Peppol network, compromising integrity and confidentiality of transaction data.