CVE-2026-109220 json
PDF Invoice for WooCommerce + Drag and Drop Template Builder <= 7.1.1 - Unauthenticated PHP Object Injection to Remote Code Execution via 'customer_note' Checkout Field
published 9d ago modified 6d ago also EUVD-2026-114594
- cvss
- 9.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 44%
- public exploits
- 0
- none known
Summary
The PDF Invoice for WooCommerce + Drag and Drop Template Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 7.1.1 via the 'customer_note' parameter parameter. This is due to insufficient sanitization of the customer_note checkout field, which is inlined verbatim into invoice HTML, entity-decoded back into a live tag by simplehtmldom, reassembled into raw bytes by mPDF, and passed to unserialize() in _getObjAttr without validation. This makes it possible for unauthenticated attackers to execute code on the server. An unauthenticated attacker can trigger the vulnerable code path on a default install by placing an anonymous WooCommerce checkout via the public Store API (POST /wc/store/v1/checkout) using a Direct Bank Transfer or cheque payment method, which automatically transitions the order to 'on-hold' status and fires the plugin's invoice-generation hook.
Is CVE-2026-109220 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- total
- Assessed
- 6d ago
Exploit prediction
0.52% chance of exploitation in the next 30 days, higher than 44% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected products
- addonsorg PDF Invoice for WooCommerce + Drag and Drop Template Builder
Classification
- Weakness
-
- CWE-502 Deserialization of Untrusted Data
- Technology feeds
References
- wordfence.com /threat-intel/vulnerabilities/id/1bc3529c-6161-4b89-8a35-c3a9b7b8c308?source=cve
- plugins.trac.wordpress.org /browser/pdf-for-woocommerce/tags/7.1.1/vendor/mpdf/mpdf/src/Mpdf.php#L9105
- plugins.trac.wordpress.org /browser/pdf-for-woocommerce/tags/7.1.1/woocommerce/shortcodes.php#L708
- plugins.trac.wordpress.org /browser/pdf-for-woocommerce/tags/7.1.1/woocommerce/emails/index.php#L70
- plugins.trac.wordpress.org /browser/pdf-for-woocommerce/tags/7.1.1/frontend/index.php#L378
- plugins.trac.wordpress.org /browser/pdf-for-woocommerce/tags/7.1.1/libs/HtmlDocument.php#L300
- plugins.trac.wordpress.org /browser/pdf-for-woocommerce/tags/7.1.1/libs/HtmlNode.php#L1266
- downloads.wordpress.org /plugin/pdf-for-woocommerce.7.2.0.zip
Sources
- CVE List CVE-2026-109220
- NVD CVE-2026-109220
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.