CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Showing 1โ1 of 1 advisories (Page 1/1)
2026-10-31
WooCommerce PDF Invoice Plugin PHP Object Injection and Remote Code Execution (RCE) Vulnerability (CVE-2026-109220)
[Affected Scope] PDF Invoice for WooCommerce + Drag and Drop Template Builder plugin versions up to, and including, 7.1.1
[Impact] Unauthenticated remote attackers can execute arbitrary PHP code on the server and fully compromise the system via malicious payload injection
[Mitigation] Immediately upgrade the plugin to the patched version (7.2.0 or higher) and apply input validation filters on checkout API requests