CVE-2026-109220

Name of the Vulnerable Software and Affected Versions PDF Invoice for WooCommerce + Drag and Drop Template Builder versions prior to 7.1.2

Description PHP Object Injection occurs due to insufficient sanitization of the customer note parameter. The input is inlined into invoice HTML, entity-decoded by simplehtmldom, reassembled into raw bytes by mPDF, and passed to the unserialize() function in getObjAttr() without validation. This allows unauthenticated attackers to execute arbitrary code on the server. The issue can be triggered via the public Store API endpoint '/wc/store/v1/checkout' by placing an anonymous WooCommerce checkout using a cheque or Direct Bank Transfer payment method, which triggers the invoice-generation hook.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Avoid using the customer note parameter in the '/wc/store/v1/checkout' endpoint until the issue is resolved.