---
id: "CVE-2026-103769"
page: "https://infrastack.ai/live/CVE-2026-103769"
kind: "vulnerability"
aliases: ["CVE-2026-103769"]
title: "WooCommerce PDF Invoices plugin: untrusted data deserialization allows object injection"
severity: "high"
cvss: 7.2
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "php", "woocommerce", "wordpress"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-11-13T15:17:28+00:00"
first_seen_at: "2026-11-13T15:46:15+00:00"
updated_at: "2026-11-13T15:48:28+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-103769", "first_seen_at": "2026-11-13T15:46:15+00:00"}]
exploit_sources: []
---

# WooCommerce PDF Invoices plugin: untrusted data deserialization allows object injection

Link for people: https://infrastack.ai/live/CVE-2026-103769 (this .md is for agents)

The Acowebs PDF Invoices and Packing Slips plugin for WooCommerce deserializes untrusted data, which allows PHP object injection. Depending on the classes available on the site, an attacker may be able to run code or change data on the store.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the WordPress site has the `pdf-invoices-and-packing-slips-for-woocommerce` plugin installed and its version in the plugin list or `wp plugin list`.
- Confirm the installed version is `1.4.10` or lower, which the sources say is affected.

## Fix

- Acowebs PDF Invoices and Packing Slips For WooCommerce: fixed version unknown; the sources say versions through `1.4.10` are affected.

## Timeline

- 2026-11-13T15:46:15+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-103769

## From the sources

Deserialization of Untrusted Data vulnerability in Acowebs PDF Invoices and Packing Slips For WooCommerce pdf-invoices-and-packing-slips-for-woocommerce allows Object Injection.This issue affects PDF Invoices and Packing Slips For WooCommerce: from n/a through 1.4.10.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_