---
id: "CVE-2026-109220"
kind: "vulnerability"
aliases: ["CVE-2026-109220"]
title: "WordPress PDF Invoice plugin: unauthenticated checkout field lets attackers run code"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "pdf-for-woocommerce", "fixed": ["7.2.0"], "affected": "<= 7.1.1", "ecosystem": "wordpress"}]
ecosystems: []
tags: ["package", "php", "self-hosted", "woocommerce", "wordpress"]
not_affected_if: ["plugin-7.2.0-or-later", "plugin-above-7.1.1", "plugin-absent"]
published_at: "2026-10-31T07:16:34+00:00"
first_seen_at: "2026-10-31T07:34:06+00:00"
updated_at: "2026-10-31T07:35:32+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109220", "first_seen_at": "2026-10-31T07:34:06+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-31T07:35:32+00:00"}]
---

# WordPress PDF Invoice plugin: unauthenticated checkout field lets attackers run code

The PDF Invoice for WooCommerce plugin for WordPress passes the customer_note checkout field into an unserialize() call during invoice generation, which is PHP Object Injection. An unauthenticated attacker can place a checkout order through the public WooCommerce Store API and trigger the flaw to execute code on the server.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress:pdf-for-woocommerce affected <= 7.1.1 fixed 7.2.0

## How to check

- Run `wp plugin get pdf-for-woocommerce --field=version` or read the version in the WordPress plugin list; 7.1.1 or lower is vulnerable, 7.2.0 is fixed.
- Exposure needs the plugin active and WooCommerce checkout open to anonymous customers (Store API POST /wc/store/v1/checkout); Direct Bank Transfer or cheque payment moves orders to on-hold and fires invoice generation.

## Fix

Update PDF Invoice for WooCommerce + Drag and Drop Template Builder (slug pdf-for-woocommerce) to 7.2.0 or later.

## Timeline

- 2026-10-31T07:34:06+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-109220
- 2026-10-31T07:35:32+00:00 analyst — Fix 7.2.0 per the plugin's own changelog (wordpress.org: 'Fixed: Security', does not name the CVE) and Patchstack (patched 7.2.0, unauthenticated, no exploitation reported). No vendor advisory, PoC or discussion found; exploitation not confirmed, severity unchanged. Check text from NVD/Wordfence description, not verified.

## Documents

- [advisory] Patchstack: PDF Invoice Builder for WooCommerce <= 7.1.1 unauthenticated deserialization, patched 7.2.0 https://patchstack.com/database/wordpress/plugin/pdf-for-woocommerce/vulnerability/wordpress-pdf-invoice-for-woocommerce-drag-and-drop-template-builder-plugin-7-1-1-unauthenticated-php-object-injection-to-remote-code-execution-vulnerability
- [fix] PDF Invoice for WooCommerce plugin page and changelog (7.2.0: Fixed: Security) https://wordpress.org/plugins/pdf-for-woocommerce/

## From the sources

The PDF Invoice for WooCommerce + Drag and Drop Template Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 7.1.1 via the 'customer_note' parameter parameter. This is due to insufficient sanitization of the customer_note checkout field, which is inlined verbatim into invoice HTML, entity-decoded back into a live tag by simplehtmldom, reassembled into raw bytes by mPDF, and passed to unserialize() in _getObjAttr without validation. This makes it possible for unauthenticated attackers to execute code on the server. An unauthenticated attacker can trigger the vulnerable code path on a default install by placing an anonymous WooCommerce checkout via the public Store API (POST /wc/store/v1/checkout) using a Direct Bank Transfer or cheque payment method, which automatically transitions the order to 'on-hold' status and fires the plugin's invoice-generation hook.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_