Unauthenticated document disclosure via billing-email authorization

IDOR in WebToffee WooCommerce PDF Invoices 5.0.2 and earlier allows remote attackers to read customer documents via email links. The print_document_from_the_mail_link handler, dispatched by print_window() on init, authorizes document access by matching the base64-encoded email parameter against the order's billing email instead of requiring its secret order_key. Exploitation requires guest document access to be enabled and knowledge of the target order ID and billing email, exposing customer contact details, addresses, purchases, and invoice data without documented modification or service interruption.