CVE-2026-109220: PDF Invoice for WooCommerce + Drag and Drop Template Builder <= 7.1.1 - Unauthenticated PHP Object Injection to Remote Code Execution via 'customer_note' Checkout Field

Q: Which sites are exposed to unauthenticated exploitation?

WordPress sites using the affected plugin through version 7.1.1 are exposed if anonymous WooCommerce checkout is available through the public Store API and a Direct Bank Transfer or cheque payment method can be used. Those payment methods transition an order to on-hold status and trigger the plugin's invoice-generation hook.

Q: What does an attacker need to do to reach the vulnerable code path?

No authentication or user interaction is required. An attacker can submit an anonymous checkout request to POST /wc/store/v1/checkout and place the payload in the customer_note checkout field, using Direct Bank Transfer or cheque as the payment method.

Q: Is the default configuration affected?

Yes. The vulnerable path can be triggered on a default install by placing an anonymous WooCommerce checkout through the public Store API with Direct Bank Transfer or cheque.

Q: What temporary mitigations are supported by the available information?

If updating is not immediately possible, prevent anonymous checkout through the public Store API or disable Direct Bank Transfer and cheque payment methods, since the described exploit path relies on an anonymous checkout reaching on-hold status and firing invoice generation.

Published Oct 31, 2026

Updated

The PDF Invoice for WooCommerce + Drag and Drop Template Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 7.1.1 via the 'customernote' parameter parameter. This is due to insufficient sanitization of the customernote checkout field, which is inlined verbatim into invoice HTML, entity-decoded back into a live tag by simplehtmldom, reassembled into raw bytes by mPDF, and passed to unserialize() in getObjAttr without validation. This makes it possible for unauthenticated attackers to execute code on the server. An unauthenticated attacker can trigger the vulnerable code path on a default install by placing an anonymous WooCommerce checkout via the public Store API (POST /wc/store/v1/checkout) using a Direct Bank Transfer or cheque payment method, which automatically transitions the order to 'on-hold' status and fires the plugin's invoice-generation hook.

Event History

Oct 31, 2026

CVE Published

via MITRE·06:44 AM

Data Sourced

via MITRE·06:44 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:16 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which sites are exposed to unauthenticated exploitation?

WordPress sites using the affected plugin through version 7.1.1 are exposed if anonymous WooCommerce checkout is available through the public Store API and a Direct Bank Transfer or cheque payment method can be used. Those payment methods transition an order to on-hold status and trigger the plugin's invoice-generation hook.

What does an attacker need to do to reach the vulnerable code path?

No authentication or user interaction is required. An attacker can submit an anonymous checkout request to POST /wc/store/v1/checkout and place the payload in the customer_note checkout field, using Direct Bank Transfer or cheque as the payment method.

Is the default configuration affected?

Yes. The vulnerable path can be triggered on a default install by placing an anonymous WooCommerce checkout through the public Store API with Direct Bank Transfer or cheque.

What temporary mitigations are supported by the available information?

If updating is not immediately possible, prevent anonymous checkout through the public Store API or disable Direct Bank Transfer and cheque payment methods, since the described exploit path relies on an anonymous checkout reaching on-hold status and firing invoice generation.

CVE-2026-109220: PDF Invoice for WooCommerce + Drag and Drop Template Builder <= 7.1.1 - Unauthenticated PHP Object Injection to Remote Code Execution via 'customer_note' Checkout Field

Event History

Frequently Asked Questions

Which sites are exposed to unauthenticated exploitation?

What does an attacker need to do to reach the vulnerable code path?

Is the default configuration affected?

What temporary mitigations are supported by the available information?

Company

Resources

Contact

Frequently Asked Questions

Which sites are exposed to unauthenticated exploitation?

What does an attacker need to do to reach the vulnerable code path?

Is the default configuration affected?

What temporary mitigations are supported by the available information?