{"id":"CVE-2026-109220","kind":"vulnerability","aliases":["CVE-2026-109220"],"related":[],"title":"WordPress PDF Invoice plugin: unauthenticated checkout field lets attackers run code","description":"The PDF Invoice for WooCommerce + Drag and Drop Template Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 7.1.1 via the 'customer_note' parameter parameter. This is due to insufficient sanitization of the customer_note checkout field, which is inlined verbatim into invoice HTML, entity-decoded back into a live tag by simplehtmldom, reassembled into raw bytes by mPDF, and passed to unserialize() in _getObjAttr without validation. This makes it possible for unauthenticated attackers to execute code on the server. An unauthenticated attacker can trigger the vulnerable code path on a default install by placing an anonymous WooCommerce checkout via the public Store API (POST /wc/store/v1/checkout) using a Direct Bank Transfer or cheque payment method, which automatically transitions the order to 'on-hold' status and fires the plugin's invoice-generation hook.","summary":"The PDF Invoice for WooCommerce plugin for WordPress passes the customer_note checkout field into an unserialize() call during invoice generation, which is PHP Object Injection. An unauthenticated attacker can place a checkout order through the public WooCommerce Store API and trigger the flaw to execute code on the server.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"pdf-for-woocommerce","fixed":["7.2.0"],"affected":"<= 7.1.1","ecosystem":"wordpress"}],"ecosystems":[],"tags":["package","php","self-hosted","woocommerce","wordpress"],"not_affected_if":["plugin-7.2.0-or-later","plugin-above-7.1.1","plugin-absent"],"how_to_check":"- Run `wp plugin get pdf-for-woocommerce --field=version` or read the version in the WordPress plugin list; 7.1.1 or lower is vulnerable, 7.2.0 is fixed.\n- Exposure needs the plugin active and WooCommerce checkout open to anonymous customers (Store API POST /wc/store/v1/checkout); Direct Bank Transfer or cheque payment moves orders to on-hold and fires invoice generation.","fix":"Update PDF Invoice for WooCommerce + Drag and Drop Template Builder (slug pdf-for-woocommerce) to 7.2.0 or later.","status":"open","published_at":"2026-10-31T07:16:34+00:00","first_seen_at":"2026-10-31T07:34:06+00:00","triaged_at":"2026-10-31T07:34:24+00:00","updated_at":"2026-10-31T07:35:32+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-31T07:34:24Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WordPress PDF Invoice plugin: unauthenticated checkout field lets attackers run code","impact":"high","summary":"The PDF Invoice for WooCommerce plugin for WordPress passes the customer_note checkout field into an unserialize() call during invoice generation, which is PHP Object Injection. An unauthenticated attacker can place a checkout order through the public WooCommerce Store API and trigger the flaw to execute code on the server.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","php","self-hosted"],"confidence":0.7,"fix_status":"unknown","needs_auth":"no","worst_case":"Unauthenticated attacker executes code on the web server","analyst_note":"No fixed version or vendor advisory is in the sources; check the plugin's changelog and the Wordfence or WordPress plugin page for a patched release.","how_to_check":"- Check the installed version of the PDF Invoice for WooCommerce + Drag and Drop Template Builder plugin in the WordPress admin plugin list, or `wp plugin get <plugin-slug> --field=version`\n- Look for a plugin version of `7.1.1` or lower\n- Confirm whether Direct Bank Transfer or cheque payments are enabled in WooCommerce, since the source says these trigger the path on a default install","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-absent","plugin-above-7.1.1"],"who_is_affected":"Sites running the PDF Invoice for WooCommerce + Drag and Drop Template Builder plugin up to and including 7.1.1 with WooCommerce checkout open to anonymous customers. The source says a default install is exposed when the order is placed with Direct Bank Transfer or cheque, which moves the order to on-hold and fires the invoice hook. Sites that do not run the plugin can skip it.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"critical"},"cost_usd":0.000788,"input_tokens":4363,"output_tokens":703,"severity_before":"critical"},"analyst_status":"done","analyst_note":"No fixed version or vendor advisory is in the sources; check the plugin's changelog and the Wordfence or WordPress plugin page for a patched release.","search":"'-109220':14A,17A '-2026':13A,16A '/wc/store/v1/checkout':193C '7.1.1':105C 'anonym':184C 'api':68B,191C 'attack':9A,57B,161C,170C 'automat':204C 'back':134C 'bank':197C 'builder':88C 'byte':144C 'call':46B 'checkout':6A,41B,61B,122C,186C 'chequ':200C 'code':11A,75B,164C,175C 'custom':39B,108C,120C 'cve':12A,15A 'decod':133C 'default':179C 'direct':196C 'drag':84C 'drop':86C 'due':114C 'entiti':132C 'entity-decod':131C 'execut':74B,163C 'field':7A,42B,123C 'fire':214C 'flaw':72B 'for':20A 'generat':49B,220C 'getobjattr':152C 'hold':211C 'hook':221C 'host':26B 'html':130C 'includ':104C 'inject':54B,97C 'inlin':126C 'instal':180C 'insuffici':116C 'invoic':3A,31B,48B,81C,129C,219C 'invoice-gener':218C 'let':8A 'live':137C 'make':156C 'method':202C 'mpdf':146C 'note':40B,109C,121C 'object':53B,96C 'on-hold':209C 'order':62B,207C 'packag':22B 'paramet':110C,111C 'pass':37B,148C 'path':176C 'payment':201C 'pdf':2A,19A,30B,80C 'pdf-for-woocommerce':18A 'php':23B,52B,95C 'place':59B,182C 'plugin':4A,34B,89C,216C 'possibl':158C 'post':192C 'public':65B,189C 'raw':143C 'reassembl':141C 'run':10A 'sanit':117C 'self':25B 'self-host':24B 'server':78B,167C 'simplehtmldom':140C 'status':212C 'store':67B,190C 'tag':138C 'templat':87C 'transfer':198C 'transit':205C 'trigger':70B,172C 'unauthent':5A,56B,160C,169C 'unseri':45B,150C 'use':194C 'valid':154C 'verbatim':127C 'version':100C 'via':106C,187C 'vulner':93C,174C 'without':153C 'woocommerc':27B,33B,66B,83C,185C 'woocommerce':21A 'wordpress':1A,28B,36B,91C","nicknames":[],"mitigations":[],"who_affected":"Sites running the PDF Invoice for WooCommerce + Drag and Drop Template Builder plugin up to and including 7.1.1 with WooCommerce checkout open to anonymous customers. The source says a default install is exposed when the order is placed with Direct Bank Transfer or cheque, which moves the order to on-hold and fires the invoice hook. Sites that do not run the plugin can skip it.","tier":"B","verified":{"fix":{"at":"2026-10-31T07:35:32Z","by":"analyst","doc":"https://patchstack.com/database/wordpress/plugin/pdf-for-woocommerce/vulnerability/wordpress-pdf-invoice-for-woocommerce-drag-and-drop-template-builder-plugin-7-1-1-unauthenticated-php-object-injection-to-remote-code-execution-vulnerability","run_id":1223}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-31T07:16:34+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-109220","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109220","severity":null,"published_at":"2026-10-31T07:16:34+00:00","modified_at":"2026-10-31T07:16:34+00:00","first_seen_at":"2026-10-31T07:34:06+00:00","fetched_at":"2026-10-31T07:34:06+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-109220:1223","url":null,"severity":null,"published_at":"2026-10-31T07:35:32+00:00","modified_at":"2026-10-31T07:35:32+00:00","first_seen_at":"2026-10-31T07:35:32+00:00","fetched_at":"2026-10-31T07:35:32+00:00","note":"Fix 7.2.0 per the plugin's own changelog (wordpress.org: 'Fixed: Security', does not name the CVE) and Patchstack (patched 7.2.0, unauthenticated, no exploitation reported). No vendor advisory, PoC or discussion found; exploitation not confirmed, severity unchanged. Check text from NVD/Wordfence description, not verified."}],"documents":[{"id":30293,"url":"https://wordpress.org/plugins/pdf-for-woocommerce/","title":"PDF Invoice for WooCommerce plugin page and changelog (7.2.0: Fixed: Security)","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":30294,"url":"https://patchstack.com/database/wordpress/plugin/pdf-for-woocommerce/vulnerability/wordpress-pdf-invoice-for-woocommerce-drag-and-drop-template-builder-plugin-7-1-1-unauthenticated-php-object-injection-to-remote-code-execution-vulnerability","title":"Patchstack: PDF Invoice Builder for WooCommerce <= 7.1.1 unauthenticated deserialization, patched 7.2.0","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}