CVE-2026-103769: WordPress PDF Invoices and Packing Slips For WooCommerce plugin <= 1.4.10 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in Acowebs PDF Invoices and Packing Slips For WooCommerce pdf-invoices-and-packing-slips-for-woocommerce allows Object Injection.This issue affects PDF Invoices and Packing Slips For WooCommerce: from n/a through 1.4.10.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pdf-invoices-and-packing-slips-for-woocommerceto a version that resolves this vulnerability.Fixed in 1.4.11
Event History
Frequently Asked Questions
Which plugin versions are affected?
PDF Invoices and Packing Slips For WooCommerce versions through 1.4.10 are affected. The available information does not identify a fixed version.
What level of access does an attacker need?
The CVSS vector indicates that an attacker needs high privileges to exploit the issue. Exploitation does not require user interaction and can be performed over the network.
What is the potential impact of successful exploitation?
Successful exploitation can affect confidentiality, integrity, and availability at a high level. The vulnerability is a PHP object injection issue caused by deserialization of untrusted data.