A critical vulnerability, CVE-2026-109220, has been published for the PDF Invoice for WooCommerce + Drag and Drop Template Builder plugin. According to the GitHub Advisory Database entry, all versions up to and including 7.1.1 are affected, and the flaw scores 9.8 out of 10 on CVSS v3.
If you run a WooCommerce store that generates PDF invoices with this plugin, this one deserves attention today. The advisory says an unauthenticated visitor can reach the vulnerable code simply by placing an order, with no account and no special setup.
What happened
The advisory was published to the GitHub Advisory Database and the National Vulnerability Database on October 31, 2026. It describes a PHP Object Injection weakness that, in the advisory's words, makes it possible for unauthenticated attackers to execute code on the server.
Coverage is thin so far. The research behind this article rests on one advisory, and the NVD record repeats the same text rather than confirming it independently. The GitHub entry is also marked as unreviewed. Treat the details below as the advisory's claims, not as independently verified findings.
Technical details
The weakness is classified as CWE-502, deserialization of untrusted data. In plain terms, PHP can turn a stored string back into a live object using unserialize(). If an attacker controls that string, they may be able to make the application build objects it never intended to, which can lead to code execution depending on what classes are available.
Per the advisory, the data path works like this:
- The customer_note checkout field is not sufficiently sanitized and is placed verbatim into the invoice HTML.
- The simplehtmldom library entity-decodes that content back into a live tag.
- The mPDF library reassembles it into raw bytes.
- The result is passed to unserialize() in _getObjAttr without validation.
What makes this notable is the trigger. The advisory states that an unauthenticated attacker can reach the code path on a default install by placing an anonymous checkout through WooCommerce's public Store API, using the Direct Bank Transfer or cheque payment method. Those methods move the order to on-hold status automatically, which fires the plugin's invoice-generation hook.
| Item | Detail |
|---|---|
| CVE | CVE-2026-109220 (GHSA-5f8r-hw67-6cx4) |
| CVSS v3 | 9.8 critical, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| Weakness | CWE-502, deserialization of untrusted data |
| Affected | All versions up to and including 7.1.1 |
| Authentication | None required |
| Fixed version | Not stated in the advisory |
We are deliberately not describing payload contents or request construction. The point for defenders is the exposure, not the exploit.
Who is affected
Any WordPress site running this plugin at version 7.1.1 or earlier with WooCommerce checkout enabled should be considered exposed. The advisory says the issue works on a default install, so you should not assume a custom configuration protects you.
The advisory names Direct Bank Transfer and cheque as the payment methods that trigger the invoice hook in the described scenario. If you have those methods disabled, that may narrow the described path, but the advisory does not say it eliminates risk, so do not rely on it as a fix.
How to check your exposure
- In the WordPress admin, open Plugins and look for PDF Invoice for WooCommerce + Drag and Drop Template Builder. Note the installed version.
- If the version is 7.1.1 or lower, treat the site as vulnerable.
- Check the plugin directory slug on the server. The advisory's code references use pdf-for-woocommerce.
- Review recent orders for unusual customer notes, especially long, encoded or strangely formatted text, and for on-hold orders you do not recognize.
- Check web server logs for repeated anonymous POST requests to the WooCommerce Store API checkout endpoint from the same addresses.
You can also look up the plugin on our known WordPress plugin vulnerabilities page, and our guide on whether a WordPress plugin is vulnerable explains how to read advisories like this one.
What to do now
The advisory lists patched versions as unknown. Its references include a download link for version 7.2.0 of the plugin, but the advisory does not say that release fixes the issue, so we cannot confirm it. Check the plugin's changelog on WordPress.org and any vendor notice before assuming an update resolves this.
- Back up the site and database first, so you can recover if something goes wrong.
- Look for a newer plugin release than 7.1.1 and read its changelog. If the vendor states the issue is fixed, update promptly, ideally on staging first.
- If no confirmed fix exists, deactivate the plugin until one does. Losing automatic PDF invoices for a while is far cheaper than a server compromise.
- If you must keep the plugin active, consider a web application firewall rule that restricts or inspects anonymous checkout requests. This reduces risk but is not a guaranteed fix. See what a WAF is for what it can and cannot do.
- Review the site for signs of compromise (see below) if the plugin was active and publicly reachable after the advisory date.
Detection and monitoring
Code execution on a store is serious because the server holds customer data and order information. After mitigating, look for unexpected admin users, new or modified PHP files in uploads and plugin directories, unfamiliar scheduled tasks, and changes to checkout page scripts. Our guides on checking whether a website is hacked and what to do if your website is hacked walk through the steps.
For ongoing coverage, Webforta Monitor can alert you to uptime, certificate, DNS and header changes, which helps you notice unexpected behavior sooner. It does not detect or block this specific vulnerability, so keep plugin updates and backups as your primary defense.
What we still do not know
- Whether a patched release exists and which version it is.
- Whether the flaw is being exploited in the wild.
- Whether a working exploit is public.
- Whether the vendor has issued its own advisory.
We will not guess at these. Check the plugin's page on WordPress.org and the Wordfence entry linked from the advisory for updates. If you manage several WooCommerce sites, the approach is the same each time: take inventory, update or disable, then review. Our WordPress security checklist covers the routine habits that make this faster.
Sources
This article is based on the public sources below. Details can change as vendors and researchers publish more; check the original advisories before acting on version numbers.
- CVE-2026-109220 - GitHub Advisory Database (github.com)
- CVE-2026-109220: The PDF Invoice for WooCommerce + Drag and Drop Template Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and… (nvd.nist.gov, )
Tags: WooCommerce, WordPress plugin, PHP object injection, CVE-2026-109220, CWE-502