Critical flaw in PDF Invoice for WooCommerce (CVE-2026-109220)

What it is and who is affectedThe plugin PDF Invoice for WooCommerce + Drag and Drop Template Builder, used on WordPress shops to generate invoices an...

What it is and who is affected

The plugin PDF Invoice for WooCommerce + Drag and Drop Template Builder, used on WordPress shops to generate invoices and delivery notes, carries a vulnerability tracked as CVE-2026-109220. According to the National Vulnerability Database (NVD) of NIST, it affects all versions up to and including 7.1.1 and was published on 31 October 2026.

The flaw is a PHP Object Injection (CWE-502) reachable through the customer_note parameter. The checkout field is not sanitised properly: it is inlined verbatim into the invoice HTML, entity-decoded back into a live tag by simplehtmldom, reassembled into raw bytes by mPDF and finally passed to unserialize() in _getObjAttr without validation. In practice, an unauthenticated attacker can reach that code path on a default installation by placing an anonymous order through the public Store API (POST /wc/store/v1/checkout) using a Direct Bank Transfer or cheque payment method. That order moves automatically to "on-hold" status and fires the plugin's invoice-generation hook.

The severity is CVSS 3.1 9.8, CRITICAL (vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). No credentials and no user interaction are needed, and the impact on confidentiality, integrity and availability is high. Any Spanish or Catalan SME running a WooCommerce shop with this plugin — whether in Barcelona, Lleida, Tarragona or Girona — should treat it as a priority, especially if the shop is hosted on its own server or managed by a small IT team.

Why it is urgent

At the time of writing, CVE-2026-109220 does not appear in CISA's KEV catalogue, and there is no public evidence that it is being exploited in real attacks. That does not make it a low-risk item. A critical, unauthenticated remote code execution path in a checkout flow is exactly the kind of surface that automated scanners find quickly, and the entry point is a public endpoint that every online shop necessarily exposes.

Two factors raise the exposure further. First, the attack does not require a registered account: an anonymous checkout is enough. Second, the vulnerable code is triggered by a normal business event — the generation of an invoice — so it runs inside the routine operation of the shop and not in some obscure admin screen. Where a payment method such as bank transfer or cheque is enabled, the path is available by default.

What to do today

Confirm whether the plugin is installed and in which version. Check the plugin list in the WordPress dashboard or the plugin directory on the server. Any version up to and including 7.1.1 is in scope.
Apply the fix indicated in the vendor's advisory. The official references point to the plugin package published on the WordPress download servers; follow the vendor's instructions rather than improvising a manual patch, and verify the resulting version before closing the task.
Look for signs of intrusion. Review orders created anonymously with bank transfer or cheque, unexpected "on-hold" entries, unusual files in the uploads directory, changes to theme or plugin files, and new or modified administrator accounts. Keep web server and WooCommerce logs long enough to reconstruct what happened.
Reduce what is exposed to the internet. If the plugin cannot be updated immediately, consider disabling the payment methods that allow anonymous checkout to reach the invoice hook, restrict access to the Store API where the shop's architecture permits it, and make sure the WordPress installation, WooCommerce and the rest of the plugins are current.
Review the rest of the stack. A plugin with an unauthenticated entry point is only one door. Server hardening, file permissions, database credentials and the WordPress admin surface all matter once an attacker is inside.

How a cybersecurity team such as ALMC's can help

Situations like this one are rarely solved by a single update. ALMC works with SMEs, online shops and small IT teams across Catalonia on security audits and pentesting to detect and close vulnerabilities before they are exploited, on server hardening and on monitoring and incident response. For WordPress, PrestaShop and Joomla sites, we handle maintenance and security patching so that advisories such as CVE-2026-109220 are identified, prioritised and applied on a defined schedule rather than after a scare.

When a site has already been compromised, we also carry out repair of hacked websites: identifying the entry point, cleaning the installation, restoring from a verified backup and closing the gap that allowed the intrusion. For a shop that processes orders and personal data under the GDPR, having a clear inventory of plugins, versions and exposed endpoints is not bureaucracy — it is the difference between a routine update and an incident with legal and commercial consequences.

Is your business exposed to flaws like this?

ALMC checks which versions you are running, applies the patches and hardens your servers and website. Contact our team for a security review.

Results without leaving the page.