External risk intelligence

PDF for WooCommerce PHP Object Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-109220

The vulnerability exists in a WordPress plugin designed for public-facing e-commerce storefronts. It is reachable via the public WooCommerce Store API, which is exposed to the internet by design to allow customers to process orders. Because it supports unauthenticated access through standard checkout workflows, the attack surface is publicly accessible in normal, default deployments of the application.

Deserialization

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in a popular WordPress plugin used for generating PDF invoices in WooCommerce. This issue could allow unauthenticated attackers to execute arbitrary code on affected servers, potentially leading to a compromise of the website and its data. The vulnerability arises from improper handling of customer notes during the checkout process, which can be exploited through the public Store API.

Plugin flaw allows unauthenticated code execution.
Public-facing e-commerce sites are vulnerable.
Confirm relevance and assess exposure.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by placing an anonymous order through the WooCommerce Store API, which is publicly accessible. The attacker manipulates the 'customer_note' field during checkout, which is then processed by the plugin. This leads to PHP Object Injection, allowing the attacker to execute arbitrary code on the server.

Requires no user login.
Triggers via checkout `customer_note` field.
Leads to remote code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could impact the confidentiality, integrity, and availability of the affected WordPress server. When supported by the advisory, an unauthenticated attacker could exploit insufficient sanitization of a checkout field to inject malicious PHP objects. This could lead to arbitrary code execution on the server, potentially compromising the entire system.

Server code execution could occur.
Via checkout API, unauthenticated.
Complete server compromise possible.

Operational Fix

Recommended remediation, mitigation, and detection steps

The WooCommerce plugin's PHP Object Injection vulnerability impacts public-facing e-commerce sites, making it critical for application owners and infrastructure teams to act. The first step is to locate all instances of the plugin, assess their reachability and business criticality, and identify the accountable owner to plan remediation.

Application and infrastructure teams should own.
Verify plugin reachability and business criticality first.
Coordinate vendor updates and plan maintenance windows.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the PDF Invoice for WooCommerce plugin?

This WordPress plugin automates the creation of professional PDF documents for e-commerce transactions. It integrates with WooCommerce to generate invoices, packing slips, and other documentation for orders, typically serving as a backend utility to simplify order management and record-keeping for store administrators.

What does PHP Object Injection mean in CVE-2026-109220?

It is a security weakness, classified as CWE-502, where an application takes untrusted data and uses it to reconstruct a PHP object without proper validation. In this case, the plugin improperly processes input from a checkout field, allowing an attacker to inject custom, malicious objects that the server then inadvertently executes as code.

How is this vulnerability triggered?

An attacker triggers the flaw by submitting a crafted note through the WooCommerce checkout process. It is important to note that simply visiting the site does not trigger the bug; the attacker must specifically use the public Store API to place an order, usually opting for payment methods like bank transfer or check that finalize the order without external processing.

Is my site at risk according to Halo Surface Signal?

Yes, if you use this plugin, your site is likely at risk. Halo Surface Signal identifies this as an external threat because the vulnerable checkout API is exposed to the internet by design to facilitate normal customer orders. Because it allows unauthenticated access, the attack surface is accessible to anyone on the web, making standard WooCommerce deployments highly reachable for exploitation.

What should I do if I run this plugin?

First, conduct an inventory to locate all instances of the plugin across your infrastructure. Assess the business criticality of those specific sites and determine who is responsible for their maintenance. Once identified, coordinate with your team to review official updates from the plugin developer and schedule a maintenance window to apply the necessary security patches.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.