addonsorg PDF Invoice for WooCommerce + Drag and Drop Template Builder, CVE-2026-109220: a new CVE scored 9.8

The bottom line

If you run a WordPress shop with WooCommerce and this invoice plugin, act today: the record says no login is needed to attack it. First find out whether the plugin is installed and which version. If you do not use it, you can stop reading.

Free analysis report · 8 pagesaddonsorg PDF Invoice for WooCommerce + Drag and Drop Template Builder, CVE-2026-109220: a new CVE scored 9.8The same note as a document you can keep or forward: what the sources say, who is affected, and what to do first.Download the analysis report →

At a glance

Does this apply to you?

What it is

The record says the plugin passes text from the checkout note field into code that rebuilds PHP objects without checking it. Someone with no account can place an order through the public checkout and run code on the server.

Why it matters

Our reading is that code execution on a shop server gives an attacker the orders, customer details and files the site can reach, and a base for further access. The record says a default install is reachable through an ordinary checkout, so no special setup protects you. A score of 9.8 with no login needed is reason enough to act before anyone exploits it.

Exposure by situation

These priorities are our judgement from what the sources say about who can use the flaw and how. They are not vendor ratings.

Things people will get wrong

• "It is not on CISA's list, so we can wait." The record is new. Not being listed yet says nothing about whether anyone is attacking it. The record says no login is needed.
• "Only customers who have accounts can reach it." The record says an unauthenticated attacker can place an anonymous checkout through the public interface.
• "We only use card payments, so we are safe." The record describes bank transfer or cheque as the route that triggers the code path. It does not say other methods are safe, so check before relying on that.

How we would triage it

This is our judgement.

Step 1: Find the versions you run

• List the active plugins on each WordPress site and note the version of this invoice plugin.
• Check staging and test copies too. They often hold the same plugin and face the internet.

Step 2: Reduce exposure while you wait

• If you cannot update at once, deactivate the plugin. The record says the flaw sits in the invoice code path, so a deactivated plugin removes it.
• Ask your host or provider whether they can block anonymous orders until the plugin is dealt with.

Step 3: Update or remove the plugin

• The record does not name a fixed version, and its range and description disagree about 7.1.1. Ask the vendor or your provider which release is fixed.
• If no fixed release is confirmed, keep the plugin off and use another way to produce invoices.

Step 4: Check afterwards

• Confirm the installed version in writing and that the plugin is updated, or off.
• Review recent orders for odd text in the customer note field.

To close it, read the version from the product itself, not from an old inventory, and save the output with the date. If you cannot update today, write down who owns it, the new date, and what limits exposure until then.

Send this to your IT provider

Copy it, change the names and dates, and send it. It is a draft for you to check, not a template tested with any provider.

Hello, we need to check our exposure to CVE-2026-109220, a flaw in the PDF Invoice for WooCommerce + Drag and Drop Template Builder plugin for WordPress. Please tell us whether any of our sites run it, on which hosts, and which version. The record says no login is needed to exploit it. It does not name a fixed version, so please confirm with the vendor which release is fixed. If we cannot update straight away, please deactivate the plugin. Please confirm the version and the fix to us in writing by the end of this week.

The weakness behind it

The record classes this as CWE-502.

The sources, in their words

The CVE record:

The PDF Invoice for WooCommerce + Drag and Drop Template Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 7.1.1 via the 'customer_note' parameter parameter. This is due to insufficient sanitization of the customer_note checkout field, which is inlined verbatim into invoice HTML, entity-decoded back into a live tag by simplehtmldom, reassembled into raw bytes by mPDF, and passed to unserialize() in _getObjAttr without validation. This makes it possible for unauthenticated attackers to execute code on the server. An unauthenticated attacker can trigger the vulnerable code path on a default install by placing an anonymous WooCommerce …

Versions of addonsorg PDF Invoice for WooCommerce + Drag and Drop Template Builder the record lists as affected:

• all versions up to, but not including, 7.1.1

What we do not know yet

• Which release is fixed: the record's range and its description disagree about whether 7.1.1 is affected.
• Whether the vendor has published an advisory or any workaround. No vendor page could be read.
• Whether any attacker is using this. The record says nothing about it.
• Whether payment methods other than bank transfer or cheque can reach the same code.
• Exploitation is not recorded. That is not the same as none.
• This is a new record: scores, versions and wording can change in the first days, and they are as at 31 October 2026. We have not read the vendor's advisory page and we have not tested it.
• The sections headed "The bottom line", "Does this apply to you?", "What it is", "Why it matters", "Exposure by situation", "Things people will get wrong", "How we would triage it" and "Send this to your IT provider" are our interpretation of the sources, not a statement by CISA or the vendor.

• The day's CVE highlight →The three new records we picked that day, and how we chose them.
• Today's mission →Every exploited vulnerability from the last seven days, in the order their deadlines fall.