CVE-2026-109220
Received Received - Intake

PHP Object Injection in PDF Invoice for WooCommerce Plugin

Publication date: 2026-10-31

Last updated on: 2026-10-31

Assigner: Wordfence

Description
The PDF Invoice for WooCommerce + Drag and Drop Template Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 7.1.1 via the 'customer_note' parameter parameter. This is due to insufficient sanitization of the customer_note checkout field, which is inlined verbatim into invoice HTML, entity-decoded back into a live tag by simplehtmldom, reassembled into raw bytes by mPDF, and passed to unserialize() in _getObjAttr without validation. This makes it possible for unauthenticated attackers to execute code on the server. An unauthenticated attacker can trigger the vulnerable code path on a default install by placing an anonymous WooCommerce checkout via the public Store API (POST /wc/store/v1/checkout) using a Direct Bank Transfer or cheque payment method, which automatically transitions the order to 'on-hold' status and fires the plugin's invoice-generation hook.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-31
Last Modified
2026-10-31
Generated
2026-10-31
AI Q&A
2026-10-31
EPSS Evaluated
N/A
NVD
CVE-2026-109220
EUVD
EUVD-2026-114594

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
addonsorg PDF Invoice for WooCommerce + Drag and Drop Template Builder 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-502 The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a PHP Object Injection flaw in the PDF Invoice for WooCommerce plugin. It allows unauthenticated attackers to execute arbitrary code on the server by exploiting insufficient sanitization of the 'customer_note' parameter during checkout. The attacker can trigger invoice generation via the WooCommerce Store API, leading to code execution through unserialize() without validation.

Detection Guidance

Check for unauthorized PHP deserialization attempts in web server logs, particularly POST requests to /wc/store/v1/checkout with customer_note parameters. Inspect plugin files for unexpected serialized data in invoice generation hooks.

Impact Analysis

If exploited, this vulnerability could allow attackers to take full control of your WordPress site, steal sensitive data, install malware, or disrupt operations. Since it requires no authentication, any unpatched site using the vulnerable plugin version is at high risk of compromise.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR and HIPAA requirements for data protection. A breach may result in legal penalties, reputational damage, and loss of compliance certifications due to exposure of sensitive customer or patient information.

Mitigation Strategies

Update the PDF Invoice for WooCommerce plugin to version 7.2.0 or later. Disable the plugin temporarily if an update is unavailable. Monitor for suspicious checkout activity via WooCommerce Store API endpoints.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109220. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart