CVE-2026-109220 is a critical PHP Object Injection flaw (CVSS 9.8) in the PDF Invoice for WooCommerce + Drag and Drop Template Builder WordPress plugin. According to NVD, an unauthenticated attacker who exploits it successfully can execute code on the server.
What Is It
The PDF Invoice for WooCommerce + Drag and Drop Template Builder plugin, from vendor addonsorg, is vulnerable to PHP Object Injection (CWE-502) through the customer_note checkout field. The plugin does not properly sanitize that field. It places the field's content unchanged into the invoice HTML. The simplehtmldom library then decodes the HTML entities back into a working tag, and mPDF turns it back into raw bytes. Finally, the data is passed to unserialize() in _getObjAttr without any validation.
According to NVD, an unauthenticated attacker can reach this code on a default install. They place an anonymous WooCommerce checkout through the public Store API (POST /wc/store/v1/checkout) and pick Direct Bank Transfer or cheque as the payment method. The order then moves to "on-hold" status on its own, which runs the plugin's invoice-generation hook.
Why It Matters
Wordfence scores this flaw CVSS 3.1 9.8 (CRITICAL), with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The attacker needs no account, no privileges and no help from a user, and the attack works over the network with low complexity. The impact on confidentiality, integrity and availability is high. NVD says successful exploitation lets an attacker execute code on the server.
The attack uses standard WooCommerce checkout features: the public Store API and common offline payment methods. As a result, many stores running a default setup are likely exposed.
As of this writing, the supplied CISA KEV data has no entry for CVE-2026-109220, so active exploitation is not confirmed. The NVD record has the status "Received" and was published 2026-10-31.
What's Vulnerable
- Product: PDF Invoice for WooCommerce + Drag and Drop Template Builder (WordPress plugin, slug
pdf-for-woocommerce) - Vendor: addonsorg
- Affected versions: All versions up to and including 7.1.1
The NVD record lists no CPEs.
Patch Status
All versions through 7.1.1 are affected. The NVD references include a download package for plugin version 7.2.0. The supplied record does not explicitly name a fixed version. Administrators should move off any version at or below 7.1.1 and check the Wordfence advisory for confirmed fix details. CISA has not issued a required action, because the supplied data contains no KEV entry.