Answer in brief
CVE-2026-109220 records a Critical severity (CVSS 9.8) vulnerability in PDF Invoice for WooCommerce + Drag and Drop Template Builder <= 7.1.1 - Unauthenticated PHP Object Injection to Remote Code Execution via 'customer_note' Checkout Field. The current sources do not mark it as known exploited. The current feed maps addonsorg/PDF Invoice for WooCommerce + Drag and Drop Template Builder (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 9.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps addonsorg/PDF Invoice for WooCommerce + Drag and Drop Template Builder (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| addonsorg/PDF Invoice for WooCommerce + Drag and Drop Template Buildergeneric | >=0 <=7.1.1 | Not reported |
Published upstream
Oct 31, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 31, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Oct 31, 2026
The PDF Invoice for WooCommerce + Drag and Drop Template Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 7.1.1 via the 'customer_note' parameter parameter. This is due to insufficient sanitization of the customer_note checkout field, which is inlined verbatim into invoice HTML, entity-decoded back into a live tag by simplehtmldom, reassembled into raw bytes by mPDF, and passed to unserialize() in _getObjAttr without validation. This makes it possible for unauthenticated attackers to execute code on the server. An unauthenticated attacker can trigger the vulnerable code path on a default install by placing an anonymous WooCommerce checkout via the public Store API (POST /wc/store/v1/checkout) using a Direct Bank Transfer or cheque payment method, which automatically transitions the order to 'on-hold' status and fires the plugin's invoice-generation hook.
Quoted source text, attributed separately from HOL analysis.