Authenticated file read via customer_note path traversal

Path traversal in WebToffee WooCommerce PDF Invoices 4.9.8 and earlier allows remote authenticated users to read arbitrary server files. The get_image_src_in_base64 function treats attacker-controlled customer_note content as an image path, reads it without restricting resolution to an allowed directory, and base64-encodes the result into cached invoice HTML. Subscriber-level access plus a valid nonce and access key reaches the Print or Download invoice endpoints; the reported consequence is limited to file confidentiality.