Zero Radar
← feed
CriticalVulnerabilityCVE-2026-109220updated 31 Oct 2026, 11:29 UTC

PDF Invoice for WooCommerce plugin lets anonymous attackers run code

A flaw in a WordPress invoice plugin lets someone with no login run harmful code on the store's server by placing a checkout order. Store owners using the affected versions need to act.

Official, 2 sources
SeverityCriticalCVSS 9.8 of 10
Being exploited?UnclearNo reports either way yet
Fix available?UnclearNo fixed version published in the sources yet
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Attacker places orderNo login needed, uses public checkout API
  2. 2Request sent to storePOST to /wc/store/v1/checkout
  3. 3Note reaches invoice codecustomer_note is unsanitized and inlined into HTML
  4. 4Malicious data deserializedunserialize() runs on attacker-controlled data
  5. ResultAttacker executes code on the server

What happened

The customer_note checkout field is inserted unsanitized into invoice HTML, then reaches unserialize() through simplehtmldom and mPDF, causing PHP Object Injection.

Why it is dangerous: Unauthenticated attackers can execute code on the server, which can compromise the whole store site and its customer data. Any WooCommerce store running the plugin with default checkout is at risk.

Are you affected?

You are affected if you run PDF Invoice for WooCommerce + Drag and Drop Template Builder version 7.1.1 or earlier on a WooCommerce store that accepts Direct Bank Transfer or cheque payments.

PDF Invoice for WooCommerce + Drag and Drop Template Builder (WordPress plugin): all versions up to and including 7.1.1

What to do

  1. Check the plugin's update page or vendor for a version newer than 7.1.1 and install it.
  2. If no fixed version is available, deactivate the plugin until one is released.
  3. Review recent orders for unexpected 'on-hold' entries with unusual customer notes.

Timeline

  1. 31 Oct 2026, 07:16 UTC
    Publicly disclosed
  2. 31 Oct 2026, 07:16 UTC
    Reported by NVD · NVD
  3. 31 Oct 2026, 07:18 UTC
    Picked up by Zero Radar
  4. 31 Oct 2026, 11:29 UTC
    GitHub Advisory reported on it · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-109220 · GHSA-5f8r-hw67-6cx4
CVSS
9.8 / 10
EPSS
0.5% chance of exploitation within 30 days
Disclosed
31 Oct 2026, 07:16 UTC
On Zero Radar
31 Oct 2026, 07:18 UTC (2 min after disclosure)
Last change
31 Oct 2026, 11:29 UTC

The plain-language parts and the attack diagram were written by an AI model (claude-haiku-5-5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

PDF Invoice for WooCommerce plugin lets anonymous attackers run code · Zero Radar