{"id":"CVE-2026-103769","kind":"vulnerability","aliases":["CVE-2026-103769"],"related":[],"title":"WooCommerce PDF Invoices plugin: untrusted data deserialization allows object injection","description":"Deserialization of Untrusted Data vulnerability in Acowebs PDF Invoices and Packing Slips For WooCommerce pdf-invoices-and-packing-slips-for-woocommerce allows Object Injection.This issue affects PDF Invoices and Packing Slips For WooCommerce: from n/a through 1.4.10.","summary":"The Acowebs PDF Invoices and Packing Slips plugin for WooCommerce deserializes untrusted data, which allows PHP object injection. Depending on the classes available on the site, an attacker may be able to run code or change data on the store.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","php","woocommerce","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check whether the WordPress site has the `pdf-invoices-and-packing-slips-for-woocommerce` plugin installed and its version in the plugin list or `wp plugin list`.\n- Confirm the installed version is `1.4.10` or lower, which the sources say is affected.","fix":"- Acowebs PDF Invoices and Packing Slips For WooCommerce: fixed version unknown; the sources say versions through `1.4.10` are affected.","status":"open","published_at":"2026-11-13T15:17:28+00:00","first_seen_at":"2026-11-13T15:46:15+00:00","triaged_at":"2026-11-13T15:48:28+00:00","updated_at":"2026-11-13T15:48:28+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-13T15:48:28Z","model":"claude-haiku-5-5","output":{"fix":"- Acowebs PDF Invoices and Packing Slips For WooCommerce: fixed version unknown; the sources say versions through `1.4.10` are affected.","reach":"internet","title":"WooCommerce PDF Invoices plugin: untrusted data deserialization allows object injection","impact":"high","summary":"The Acowebs PDF Invoices and Packing Slips plugin for WooCommerce deserializes untrusted data, which allows PHP object injection. Depending on the classes available on the site, an attacker may be able to run code or change data on the store.","audience":"businesses","category":"package","nicknames":[],"who_cares":["woocommerce","wordpress","php"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker injects PHP objects, possibly leading to code execution or data changes","analyst_note":"Find the patched version and the vulnerable endpoint in the NVD entry or the plugin changelog at https://nvd.nist.gov/vuln/detail/CVE-2026-103769.","how_to_check":"- Check whether the WordPress site has the `pdf-invoices-and-packing-slips-for-woocommerce` plugin installed and its version in the plugin list or `wp plugin list`.\n- Confirm the installed version is `1.4.10` or lower, which the sources say is affected.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Stores running the Acowebs PDF Invoices and Packing Slips For WooCommerce plugin at version 1.4.10 or lower are affected. The sources do not say which request paths or settings make the object injection reachable, so the exposure of any given site is unknown.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000777,"input_tokens":4576,"output_tokens":638,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-103769':13A,16A '-2026':12A,15A '1.4.10':98C 'abl':51B 'acoweb':22B,67C 'affect':87C 'allow':8A,35B,83C 'attack':48B 'avail':43B 'chang':56B 'class':42B 'code':54B 'cve':11A,14A 'data':6A,33B,57B,64C 'depend':39B 'deseri':7A,31B,61C 'inject':10A,38B 'injection.this':85C 'invoic':3A,24B,69C,77C,89C 'issu':86C 'may':49B 'n/a':96C 'object':9A,37B,84C 'pack':26B,71C,79C,91C 'packag':17B 'pdf':2A,23B,68C,76C,88C 'pdf-invoices-and-packing-slips-for-woocommerc':75C 'php':18B,36B 'plugin':4A,28B 'run':53B 'site':46B 'slip':27B,72C,80C,92C 'store':60B 'untrust':5A,32B,63C 'vulner':65C 'woocommerc':1A,19B,30B,74C,82C,94C 'wordpress':20B","nicknames":[],"mitigations":[],"who_affected":"Stores running the Acowebs PDF Invoices and Packing Slips For WooCommerce plugin at version 1.4.10 or lower are affected. The sources do not say which request paths or settings make the object injection reachable, so the exposure of any given site is unknown.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","package","php","woocommerce","wordpress"],"campaign_type":null,"search_a":"'-103769':13A,16A '-2026':12A,15A 'allow':8A 'cve':11A,14A 'data':6A 'deseri':7A 'inject':10A 'invoic':3A 'object':9A 'pdf':2A 'plugin':4A 'untrust':5A 'woocommerc':1A","search_b":"'abl':51B 'acoweb':22B 'allow':35B 'attack':48B 'avail':43B 'chang':56B 'class':42B 'code':54B 'data':33B,57B 'depend':39B 'deseri':31B 'inject':38B 'invoic':24B 'may':49B 'object':37B 'pack':26B 'packag':17B 'pdf':23B 'php':18B,36B 'plugin':28B 'run':53B 'site':46B 'slip':27B 'store':60B 'untrust':32B 'woocommerc':19B,30B 'wordpress':20B","search_c":"'1.4.10':98C 'acoweb':67C 'affect':87C 'allow':83C 'data':64C 'deseri':61C 'injection.this':85C 'invoic':69C,77C,89C 'issu':86C 'n/a':96C 'object':84C 'pack':71C,79C,91C 'pdf':68C,76C,88C 'pdf-invoices-and-packing-slips-for-woocommerc':75C 'slip':72C,80C,92C 'untrust':63C 'vulner':65C 'woocommerc':74C,82C,94C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T15:17:28+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-103769","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103769","severity":null,"published_at":"2026-11-13T15:17:28+00:00","modified_at":"2026-11-13T15:17:28+00:00","first_seen_at":"2026-11-13T15:46:15+00:00","fetched_at":"2026-11-13T15:46:15+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}