CVE-2026-109220: WooCommerce PDF Invoice RCE

Are You Affected?

CVE-2026-109220 affects the WordPress plugin PDF Invoice for WooCommerce + Drag and Drop Template Builder, whose WordPress.org package slug is pdf-for-woocommerce.

The vulnerable code reportedly processes the WooCommerce customer_note checkout field during invoice generation. Your site may be affected if the plugin is installed and active at version 7.1.1 or earlier, particularly when the site exposes a public WooCommerce checkout flow.

The reported attack path uses:

POST /wc/store/v1/checkout

According to the available description, an attacker can submit crafted content through customer_note during an anonymous checkout. Direct Bank Transfer or cheque payment methods may cause the order to transition to on-hold, which can trigger invoice generation and the vulnerable processing path.

The available research identifies version 7.2.0 as the remediation target through the official WordPress.org package. The supplied NVD material does not include detailed vendor release notes proving which code changes fixed the vulnerability. Treat 7.2.0 as the minimum upgrade target, verify the installed version after deployment, and monitor the site for compromise.

Analyst’s Take: Upgrade first. The affected path is a public checkout endpoint, and the reported attack does not require a WordPress account. Although no public PoC or confirmed exploitation was identified, that absence does not offset the risk of running version 7.1.1 or earlier on an internet-facing store.

The Fix, If You’re in a Hurry

Upgrade PDF Invoice for WooCommerce to 7.2.0 or later. If the plugin cannot be upgraded immediately, deactivate and remove it, then validate that invoice-generation functionality is no longer reachable.

A temporary restriction on anonymous WooCommerce checkout, Direct Bank Transfer, or cheque payment methods may reduce exposure. However, these controls can disrupt legitimate transactions and should not replace upgrading or removing the vulnerable plugin.

For WP-CLI-managed installations, inspect the current plugin state:

wp plugin get pdf-for-woocommerce \
  --field=version \
  --allow-root

wp plugin status pdf-for-woocommerce \
  --allow-root

If the plugin is active and an update is available through the configured WordPress update source, upgrade it:

wp plugin update pdf-for-woocommerce --allow-root

Confirm the resulting version:

wp plugin get pdf-for-woocommerce \
  --fields=name,status,version \
  --format=table \
  --allow-root

If you cannot safely upgrade, deactivate the plugin:

wp plugin deactivate pdf-for-woocommerce --allow-root

Remove it only after confirming that the site does not require its stored invoice data or configuration:

wp plugin delete pdf-for-woocommerce --allow-root

Disabling only a payment method is not a complete fix. The underlying issue involves attacker-controlled checkout data reaching unsafe processing logic, so the plugin should remain unavailable until a fixed release is installed.

After upgrading, review administrator accounts, WordPress scheduled tasks, recently modified PHP files, web-server configuration, and outbound connections for evidence of post-exploitation. Organizations should also review their broader WordPress plugin security processes and verify that vulnerable plugins are inventoried across production, staging, and abandoned sites.

How This Vulnerability Works

The vulnerability is described as a PHP object injection issue caused by insufficient handling of the WooCommerce customer_note field. An attacker places crafted content in that field during an anonymous checkout. The plugin then inserts the value into invoice HTML without adequate validation.

The reported processing chain is significant because multiple transformations occur before deserialization:

1. The attacker submits a public WooCommerce checkout request.
2. The malicious value is supplied through customer_note.
3. The plugin places the value into invoice HTML.
4. simplehtmldom decodes HTML entities back into a live tag.
5. mPDF reconstructs the content as raw bytes.
6. The data reaches unserialize() through _getObjAttr.
7. PHP object deserialization may invoke available gadget chains and result in arbitrary code execution.

The relevant request path is:

POST /wc/store/v1/checkout

According to the NVD description, Direct Bank Transfer or cheque payment methods can cause the order to transition to on-hold. That transition fires the plugin’s invoice-generation hook, allowing the attacker-controlled value to reach the vulnerable processing path. The reported attack therefore does not depend on an authenticated WordPress session.

The issue is not simply HTML injection. The dangerous behavior is the eventual use of attacker-influenced data in PHP deserialization. Whether a complete exploit succeeds depends on the installed PHP runtime, available classes, autoloaded libraries, WordPress and plugin versions, and the presence of a usable gadget chain.

Those environmental variables affect exploit reliability and impact, but they do not make the vulnerable code safe.

Technical Notes

The affected source references identified in the research include the 7.1.1 plugin tree:

• frontend/index.php, around line 378
• libs/HtmlDocument.php, around line 300
• libs/HtmlNode.php, around line 1266
• vendor/mpdf/mpdf/src/Mpdf.php, around line 9105

Use these references for code review and validation against the deployed package, not as a substitute for upgrading. A local comparison can help confirm that production is not still running the vulnerable release:

wp plugin get pdf-for-woocommerce --field=version --allow-root

# If the plugin directory is available locally:
grep -RIn --include='*.php' \
  -E 'unserialize\s*\(|customer_note|_getObjAttr' \
  wp-content/plugins/pdf-for-woocommerce/

The grep result is not proof of exploitability or remediation. It is a triage aid for identifying the relevant data flow and confirming whether an old package remains on disk.

Severity, Explained

NVD rates CVE-2026-109220 CVSS 9.8 Critical. The supplied record did not expose the complete vector string, so organizations that require the exact machine-readable vector should retrieve it directly from the NVD record before importing the score into a risk system.

The score is consistent with a vulnerability that is remotely reachable over the network, requires no authentication, and has high potential impact across confidentiality, integrity, and availability. According to the published description, an attacker does not need an existing WordPress account.

A successful exploit could allow server-side code execution, which may lead to:

• Modification of WordPress files
• Theft of database and customer data
• Creation of administrator accounts
• Malicious changes to payment pages
• Installation of persistent malware
• Use of the host to attack other systems

CVSS describes technical severity, not the probability that a particular site will be attacked. Exposure depends on whether the plugin is installed, whether the checkout path is publicly available, how the site handles payment methods, and what defenses surround the WordPress application.

The absence of a public exploit or KEV listing does not reduce the technical impact of a successful compromise. Internet-facing stores should patch before lower-risk maintenance work, preserve relevant logs, and perform a focused compromise review after remediation.

Is It Being Exploited?

No confirmed in-the-wild exploitation was established from the sources reviewed for this article. CVE-2026-109220 was not listed in CISA’s Known Exploited Vulnerabilities catalog as of 2026-10-31.

No verified public proof-of-concept repository or exploit link was identified in the supplied NVD references and reviewed search results. The current status should therefore be stated precisely:

Active exploitation is not confirmed, and a public PoC is not verified.

That status is not an assurance of safety. The attack reportedly uses a normal public Store API checkout request rather than a complicated administrative interface. Once technical details become available, exploitation may be adapted quickly, particularly against WordPress sites with predictable plugin layouts and permissive checkout configurations.

Defenders should use the absence of confirmed exploitation to guide detection and prioritization, not to defer patching. Teams reviewing related identity and access risks may also benefit from understanding identity attacks when investigating newly created administrator accounts or credential misuse after a suspected compromise.