CVE-2026-109220

Summary

The PDF Invoice for WooCommerce plugin suffers from a PHP Object Injection vulnerability (CWE-502) due to unsanitized user input ('customer_note') being processed through HTML parsing and PDF generation libraries that ultimately call unserialize() on attacker-controlled data, enabling unauthenticated remote code execution.

Exploitability

Exploitation is straightforward for unauthenticated attackers: they can trigger the vulnerable code path by submitting a malicious checkout request via the public Store API using any payment method that transitions the order to 'on-hold' status, such as Direct Bank Transfer or cheque.

Blast radius

Successful exploitation would allow full compromise of the affected WordPress site, including server-side code execution, data exfiltration, and potential lateral movement within the hosting environment.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 7.1.2 or later, where the plugin vendor has patched the unsanitized 'customer_note' handling.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.