CVE-2026-39472

Name of the Vulnerable Software and Affected Versions WooCommerce PDF Invoices & Packing Slips versions prior to 5.9.0

Description The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress allows authenticated attackers with shop manager-level access or higher to perform PHP Object Injection. This occurs through the deserialization of untrusted input, which is the process of converting a stored string back into a PHP object. While no native POP chain (a sequence of gadgets used to execute malicious code) exists within the plugin, the presence of a POP chain in another installed plugin or theme could enable the attacker to execute code, retrieve sensitive data, or delete arbitrary files.

Recommendations Update to version 5.9.0 or later.