PDF Invoice for WooCommerce: PHP Object Injection (CVE-2026-109220)
A PHP Object Injection vulnerability (CVSS 9.8) was found in the PDF Invoice for WooCommerce + Drag and Drop Template Builder plugin. The customer_note checkout field is not sanitized sufficiently, so an unauthenticated attacker can execute code on the server.
Checked in Shield: no
Who is affected
All plugin versions up to and including 7.1.1 are affected. The attack uses the public WooCommerce Store API (POST /wc/store/v1/checkout) with a Direct Bank Transfer or cheque payment method.
How to check
In the WordPress admin, open Plugins, find PDF Invoice for WooCommerce + Drag and Drop Template Builder and check its version. Version 7.1.1 or lower is in the affected range.
How to fix
A fixed version has not been stated yet. Watch for plugin updates and install the patch as soon as it is released.
What Shield checks not checked
Checked in Shield: no. This is usually not visible from outside, or the check has not been added yet; we collect such cases and add checks in batches.
Good to know
The fixed version and whether the flaw is exploited in the wild are not disclosed yet. Source: NVD.
