CVE-2026-109220: PHP Object Injection in the WooCommerce plugin pdf-for-woocommerce
This text was generated using artificial intelligence (AI).For the WordPress plugin PDF Invoice for WooCommerce + Drag and Drop Template Builder on October 31, 2026, the vulnerability CVE-2026-109220 was published. According to Wordfence, it affects all versions of pdf-for-woocommerce up to and including 7.1.1. The vulnerability is categorized as CVSS 9.8 rated.
Affected installations should check the patch status and upgrade to version 7.2.0 or higher Update.
CVE-2026-109220 affects the plugin pdf-for-woocommerce, which generates invoices for WooCommerce instances. Wordfence describes the cause as PHP Object Injection through the parameter customer_note.
The input from this field is incorporated into the HTML content of an invoice. The content is then processed by simplehtmldom and mPDF , where data is passed to unserialize in _getObjAttr, without any validation. According to Wordfence, an unauthenticated attacker can execute code on the server as a result.
Publicly Accessible Checkout as an Attack Path
The affected process can be accessed via POST /wc/store/v1/checkout triggered in the WooCommerce Store API. Wordfence describes an attack path via an anonymous order using the payment methods Direct Bank Transfer or cheque. The order status changes to on-hold and triggers the invoice generation of the plugin.
Therefore, especially publicly accessible WooCommerce shops with an installed pdf-for-woocommerce are relevant. The assessment with CVSS 9.8, network access, low attack complexity, and lack of authentication and user interaction underline the urgency of the review.
Measures: Check patch status and monitor usage
The following steps result for the processing of CVE-2026-109220:
Assess impact and patch status for pdf-for-woocommerce Check.
the plugin on version 7.2.0 or higher Update.
Prioritize affected systems based on their public accessibility and business relevance.
Monitor the WooCommerce Store API, especially POST /wc/store/v1/checkout, for unexpected usage.
Establish continuous vulnerability and vendor risk monitoring.
At the time of publication, according to Wordfence, no active exploitation was known. This status does not change the necessity to promptly check publicly accessible shop installations and their patch status.
WooCommerce is widely used in the DACH region. Operators of online shops that process customer data via the plugin should check whether a data breach exists that triggers a reporting obligation under Art. 33 GDPR within 72 hours to the responsible supervisory authority. In Germany and Austria, an NIS-2 obligation for operators of essential or important services may also be relevant; Swiss organizations are subject to reporting obligations under the revised Information Security Act (ISG) to the BACS.
Capture external shop instances as audit objects
External Attack Surface Management helps to make web applications and publicly accessible interfaces under one's own domains visible as audit objects. For CVE-2026-109220, this particularly concerns WooCommerce shops, plugin asset paths, and accessible store API endpoints.
LocateRisk supports the external inventory of exposed systems and deployed software. The results can be used for assessing impact, patch status, and prioritization. External visibility serves to identify audit-relevant assets; the technical assessment and updating of the respective installation remain necessary.
Additionally, continuous vendor risk monitoring can include dependencies of deployed software providers and components in the risk assessment.
Am I affected?
The affected version is for WooCommerce in the aforementioned versions; the vulnerability has been fixed in 7.2.0. Those who want to know whether for WooCommerce is at all visible in their externally accessible infrastructure can use the CVE Quick Check Use the tool at the end of this article: It shows exposed systems and the software that is visible from the outside.
It is not always possible to determine the specific version that has been installed from the outside—the key factor is comparing it with the manufacturer's advisory.
PHP Object Injection is a vulnerability where untrusted input is passed to the PHP function unserialize without validation. An attacker can then inject crafted objects that can execute malicious code or trigger other security-relevant actions during the deserialization process.
All versions of the plugin are affected up to and including 7.1.1. A patch is available with Version 7.2.0 , which affected installations should update to.
The most important step is to update the plugin to version 7.2.0 or higher. Additionally, it is advisable to monitor the WooCommerce Store API — especially the endpoint POST /wc/store/v1/checkout — for unexpected or anomalous requests and to regularly audit publicly accessible shop instances as part of an asset inventory.
As of October 31, 2026. This article is for informational purposes only and does not constitute legal, security, or action advice in individual cases. The security situation and patch availability may have changed since publication; the linked vendor advisory is always authoritative. Despite careful research, we do not guarantee the timeliness, accuracy, and completeness.
CVE Quick Check
In just a few minutes, check whether there are any indications of a current CVE on your externally visible attack surface.
Initial assessment in just a few minutes via email.
Learn more during a free consultation with a LocateRisk consultant.
You'll receive this by email
companyYour Company, LLC
Verified CVECVE-2026-109220
Passive Assessment
Information About the CVEfound or not found
Want to find out more, book a demo or simply exchange ideas? We look forward to hearing from you!
We use cookies to optimize our website and our service.
Functional
Always active
Technical storage or access is strictly necessary for the lawful purpose of enabling the use of a particular service expressly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a message over an electronic communications network.
Preferences
The technical storage or access is necessary for the legitimate purpose of storing preferences that have not been requested by the subscriber or user.
Statistics
The technical storage or access, which is carried out exclusively for statistical purposes.Technical storage or access used solely for anonymous statistical purposes. Without a subpoena, the voluntary consent of your Internet service provider, or additional records from third parties, information stored or accessed for this purpose alone generally cannot be used to identify you.
Marketing
Technical storage or access is necessary to create user profiles, to send advertisements, or to track the user on a website or across multiple websites for similar marketing purposes.
English 
Deutsch 
Français