Live › vulnerability › CVE-2026-109220
The PDF Invoice for WooCommerce plugin for WordPress passes the customer_note checkout field into an unserialize() call during invoice generation, which is PHP Object Injection. An unauthenticated attacker can place a checkout order through the public WooCommerce Store API and trigger the flaw to execute code on the server.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-31 07:34 UTC. All times on this page are UTC.
Sites running the PDF Invoice for WooCommerce + Drag and Drop Template Builder plugin up to and including 7.1.1 with WooCommerce checkout open to anonymous customers. The source says a default install is exposed when the order is placed with Direct Bank Transfer or cheque, which moves the order to on-hold and fires the invoice hook. Sites that do not run the plugin can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| pdf-for-woocommerce | wordpress | <= 7.1.1 | 7.2.0 |
wp plugin get pdf-for-woocommerce --field=version or read the version in the WordPress plugin list; 7.1.1 or lower is vulnerable, 7.2.0 is fixed.Update PDF Invoice for WooCommerce + Drag and Drop Template Builder (slug pdf-for-woocommerce) to 7.2.0 or later.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The PDF Invoice for WooCommerce + Drag and Drop Template Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 7.1.1 via the 'customer_note' parameter parameter. This is due to insufficient sanitization of the customer_note checkout field, which is inlined verbatim into invoice HTML, entity-decoded back into a live tag by simplehtmldom, reassembled into raw bytes by mPDF, and passed to unserialize() in _getObjAttr without validation. This makes it possible for unauthenticated attackers to execute code on the server. An unauthenticated attacker can trigger the vulnerable code path on a default install by placing an anonymous WooCommerce checkout via the public Store API (POST /wc/store/v1/checkout) using a Direct Bank Transfer or cheque payment method, which automatically transitions the order to 'on-hold' status and fires the plugin's invoice-generation hook.
This page as .md · .json · in your agent: get_signal("CVE-2026-109220")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.