CVE-2026-109220: Critical RCE in WooCommerce Invoice Plugin

CVE-2026-109220 describes a PHP Object Injection vulnerability in the PDF Invoice for WooCommerce + Drag and Drop Template Builder plugin. The flaw resides in the 'customer_note' parameter of the checkout form: the absence of sanitization allows injection of serialized data that is deserialized via unserialize() without validation. Anyone accessing the public checkout of a WooCommerce store, even anonymously, can execute arbitrary PHP code on the server.

Criticality is confirmed by a CVSS score of 9.8 (Critical). The attack requires no authentication: an anonymous user can trigger the vulnerability through the public API /wc/store/v1/checkout by selecting payment methods such as Direct Bank Transfer or cheque, which automatically activate the plugin's invoice generation hook. The CVE was published on October 31, 2026. Discussion signals on X indicate awareness of the flaw, although that content is unverified; consistency with the official technical description is evident.

Administrators of WooCommerce sites must update the plugin immediately. Check the WordPress repository for available patched versions and install the update promptly. Review POST /wc/store/v1/checkout access logs for abnormal activity, implement specific WAF rules, and disable the plugin until a secure version is available if necessary. A compromise would grant full control of the server, application, and sensitive store data.