Critical RCE flaw found in PDF Invoice for WooCommerce
The vulnerability, tracked as CVE-2026-109220, has a CVSS 3.1 score of 9.8 and affects versions 7.1.1 and below, according to dailysecu.com.
A critical vulnerability in the PDF Invoice for WooCommerce plugin, used by WordPress-based online shops, was disclosed on October 31, according to dailysecu.com. The flaw is registered as CVE-2026-109220 and carries a CVSS 3.1 score of 9.8.
Versions 7.1.1 and below are affected. The developer has released version 7.2.0 to address the issue.
The vulnerability occurs when customer order notes are converted into PDF invoices, a process that allows unauthenticated remote code execution. Shops that allow guest checkout may let non-registered attackers reach the vulnerable function.
No exploitation in the wild or leak of personal data has been confirmed so far. Operators are advised to update to version 7.2.0 or later.
Quick answers
Which versions of PDF Invoice for WooCommerce are affected?
Versions 7.1.1 and below are affected by CVE-2026-109220.
How do I fix the vulnerability?
The developer has released version 7.2.0; operators are advised to update to that version or later.
Is the flaw being exploited?
No exploitation in the wild or personal data leak has been confirmed so far.