{
    "dataType": "CVE_RECORD",
    "dataVersion": "5.2",
    "cveMetadata": {
        "cveId": "CVE-2026-109220",
        "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "state": "PUBLISHED",
        "assignerShortName": "Wordfence",
        "dateReserved": "2026-10-12T13:45:04.679Z",
        "datePublished": "2026-10-31T06:44:14.919Z",
        "dateUpdated": "2026-10-31T06:44:14.919Z"
    },
    "containers": {
        "cna": {
            "providerMetadata": {
                "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
                "shortName": "Wordfence",
                "dateUpdated": "2026-10-31T06:44:14.919Z"
            },
            "affected": [
                {
                    "vendor": "addonsorg",
                    "product": "PDF Invoice for WooCommerce + Drag and Drop Template Builder",
                    "versions": [
                        {
                            "version": "0",
                            "status": "affected",
                            "lessThanOrEqual": "7.1.1",
                            "versionType": "semver"
                        }
                    ],
                    "defaultStatus": "unaffected"
                }
            ],
            "descriptions": [
                {
                    "lang": "en",
                    "value": "The PDF Invoice for WooCommerce + Drag and Drop Template Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 7.1.1 via the 'customer_note' parameter parameter. This is due to insufficient sanitization of the customer_note checkout field, which is inlined verbatim into invoice HTML, entity-decoded back into a live tag by simplehtmldom, reassembled into raw bytes by mPDF, and passed to unserialize() in _getObjAttr without validation. This makes it possible for unauthenticated attackers to execute code on the server. An unauthenticated attacker can trigger the vulnerable code path on a default install by placing an anonymous WooCommerce checkout via the public Store API (POST /wc/store/v1/checkout) using a Direct Bank Transfer or cheque payment method, which automatically transitions the order to 'on-hold' status and fires the plugin's invoice-generation hook."
                }
            ],
            "title": "PDF Invoice for WooCommerce + Drag and Drop Template Builder <= 7.1.1 - Unauthenticated PHP Object Injection to Remote Code Execution via 'customer_note' Checkout Field",
            "references": [
                {
                    "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1bc3529c-6161-4b89-8a35-c3a9b7b8c308?source=cve"
                },
                {
                    "url": "https://plugins.trac.wordpress.org/browser/pdf-for-woocommerce/tags/7.1.1/vendor/mpdf/mpdf/src/Mpdf.php#L9105"
                },
                {
                    "url": "https://plugins.trac.wordpress.org/browser/pdf-for-woocommerce/tags/7.1.1/woocommerce/shortcodes.php#L708"
                },
                {
                    "url": "https://plugins.trac.wordpress.org/browser/pdf-for-woocommerce/tags/7.1.1/woocommerce/emails/index.php#L70"
                },
                {
                    "url": "https://plugins.trac.wordpress.org/browser/pdf-for-woocommerce/tags/7.1.1/frontend/index.php#L378"
                },
                {
                    "url": "https://plugins.trac.wordpress.org/browser/pdf-for-woocommerce/tags/7.1.1/libs/HtmlDocument.php#L300"
                },
                {
                    "url": "https://plugins.trac.wordpress.org/browser/pdf-for-woocommerce/tags/7.1.1/libs/HtmlNode.php#L1266"
                },
                {
                    "url": "https://downloads.wordpress.org/plugin/pdf-for-woocommerce.7.2.0.zip"
                }
            ],
            "problemTypes": [
                {
                    "descriptions": [
                        {
                            "lang": "en",
                            "description": "CWE-502 Deserialization of Untrusted Data",
                            "cweId": "CWE-502",
                            "type": "CWE"
                        }
                    ]
                }
            ],
            "metrics": [
                {
                    "cvssV3_1": {
                        "version": "3.1",
                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                        "baseScore": 9.8,
                        "baseSeverity": "CRITICAL"
                    }
                }
            ],
            "credits": [
                {
                    "lang": "en",
                    "type": "finder",
                    "value": "Osman Hussein"
                }
            ],
            "timeline": [
                {
                    "time": "2026-10-12T13:59:56.000Z",
                    "lang": "en",
                    "value": "Vendor Notified"
                },
                {
                    "time": "2026-10-30T17:33:25.000Z",
                    "lang": "en",
                    "value": "Disclosed"
                }
            ]
        }
    }
}