Security notice
WooCommerce store using PDF Invoice for WooCommerce? A flaw rated 9.8 needs no login. Update to 7.2.0.
PDF Invoice for WooCommerce + Drag and Drop Template Builder is a WordPress plugin that makes PDF invoices for WooCommerce orders. WordPress.org shows 500+ active installations. On October 30, 2026, security firm Patchstack published a critical flaw in it, and the CVE record, assigned by Wordfence, rates it 9.8 out of 10. Versions up to and including 7.1.1 can be attacked by a stranger with no login, through the note a shopper can type at checkout, and the CVE record says that can let the attacker run code on your server. Version 7.2.0, released October 28, fixes it. We found no report of attacks and CISA does not list it as exploited, but Patchstack says flaws like this are "expected to become exploited" in mass attacks. If your store runs this plugin, update to 7.2.0 or later today. If you cannot, ask your developer or host about turning it off until you can.
What happened
- The flaw. The CVE record describes an "unauthenticated PHP Object Injection" that leads to remote code execution. In plain words, the plugin can be tricked into treating text from a shopper as trusted data and turning it into program objects on your server, and no account is needed to try. Patchstack says attackers can use this to "run commands or gain extra access." (CVE record, Patchstack)
- How an attack starts. The CVE record says the shopper's note typed at checkout is what reaches the vulnerable code, when an order is placed by an anonymous visitor who chooses bank transfer or cheque as the payment method, and that this works on a default install. We are leaving out the technical details. The record does not say whether a store with those two payment methods switched off is safe, so do not assume it is. (CVE record, GitHub advisory)
- How serious. The CVE record rates it CVSS 9.8, which is 9.8 out of 10 and critical: reachable over the internet, low complexity, no account and no visitor interaction needed. Patchstack gives it the same score and lists the privilege needed as "Unauthenticated." (CVE record, Patchstack)
- Affected and fixed versions. PDF Invoice for WooCommerce + Drag and Drop Template Builder 7.1.1 and earlier. Version 7.2.0 is the fixed version. The plugin's folder name is
pdf-for-woocommerce; Patchstack's page calls it "PDF Invoice Builder for WooCommerce." (CVE record, Patchstack) - The dates. WordPress.org shows 7.2.0 was released at 11:31 PM ET on October 28 (3:31 AM GMT on October 29). The CVE record says the vendor was notified on October 12 and the flaw was disclosed on October 30 at 1:33 PM ET (17:33 UTC). Patchstack published its entry on October 30. The CVE record was published at 2:44 AM ET on October 31, and the GitHub advisory followed on October 31. So the fix came out about two days before the public details, and a site that updated since October 29 already has it. The CVE record credits the finder as Osman Hussein. (WordPress.org, CVE record, Patchstack, GitHub advisory)
- The plugin's changelog. The 7.2.0 entry on WordPress.org reads only "Fixed: Security." It does not name the flaw or the CVE number. We rely on Patchstack and the CVE record for the statement that 7.2.0 fixes this flaw. (WordPress.org)
- No attacks reported yet. CISA KEV does not list it in its version dated October 30, 2026, and we found no report that it is being attacked. That does not mean it has not been. Patchstack says the flaw is "highly dangerous and expected to become exploited," and that flaws like this are used in mass campaigns against thousands of sites regardless of traffic. The NVD entry was still waiting for its own review when we checked. (Patchstack, NVD)
- Patchstack customers. Patchstack says it has issued a mitigation rule for its own customers. That is not a replacement for updating. (Patchstack)
Who should worry
This is about WordPress websites that run WooCommerce and use the PDF Invoice for WooCommerce plugin. If you are not sure whether your site uses it, ask your web developer or agency. Ask about this if any of these are true:
- Your WooCommerce store uses PDF Invoice for WooCommerce + Drag and Drop Template Builder and is on version 7.1.1 or earlier.
- Your store lets shoppers pay by bank transfer or cheque.
- Automatic plugin updates are off on your site, or you are not sure they are on.
- An agency or developer set up your invoices and you do not know which plugin makes them.
- You run a web agency or host and look after WooCommerce stores for clients.
Other PDF invoice plugins have similar names. This notice is only about the one named here. If your site does not use it, this notice does not apply to you.
What to do now
Do these today.
- Check if you have it. In your WordPress dashboard, open Plugins, then Installed Plugins, and look for "PDF Invoice for WooCommerce + Drag and Drop Template Builder." Note the version number. If it says 7.2.0 or higher, you have the fix.
- Update. Update the plugin to 7.2.0 or later. Take a backup first. Updating does not change the plugin's PHP minimum: the WordPress.org files list PHP 7.0 as the minimum for both 7.1.1 and 7.2.0. (Patchstack, WordPress.org)
- If you cannot update today, ask your developer or host whether to deactivate the plugin until you can. That is a general precaution, not the plugin maker's advice, and your invoices will stop being made while it is off. Patchstack's own advice is to update and, if you cannot, to ask your host or developer for help. (Patchstack)
- Check for a break-in. No signs of attack have been published, so there is nothing specific to look for. As a general check, especially if you were on 7.1.1 or earlier for several days with bank transfer or cheque payments switched on, ask your developer or host to review recent orders for unusual or very long customer notes, and to look for administrator accounts you do not recognize, plugins you did not install and PHP files you did not put there.
- Check your store afterwards. Place a test order and confirm the invoice still comes out as you expect.
What to send your developer, agency or host
PDF Invoice for WooCommerce + Drag and Drop Template Builder (pdf-for-woocommerce) 7.1.1 and earlier has an unauthenticated PHP object injection flaw that can lead to remote code execution, CVE-2026-109220 (CVSS 9.8, assigned by Wordfence). It is fixed in 7.2.0, released October 28. CISA does not list it as exploited, but Patchstack expects mass attacks. Please tell us whether our store runs this plugin and which version. If it is 7.1.1 or earlier, please update to 7.2.0 or later today, or deactivate it until you can. Please then review recent orders for unusual customer notes and check for unfamiliar administrators, plugins or PHP files, and tell us what you find. Sources: Patchstack, the CVE record, the GitHub advisory, WordPress.org.
Common questions
Has my store been hacked?
This notice does not mean your store has been hacked. It means a critical flaw has been published and a fix is out. We found no report of attacks.
Can EverThread tell me if I am affected?
No. EverThread does not test for this. We check your home page from the outside, the way a browser sees it. We cannot see which plugins your site runs or which versions they are on, so if our scan does not warn you about this plugin, that does not mean you are safe. Our free scan does look at your home page for other common problems, such as an expired padlock certificate, missing browser safety settings and files that should not be public.
I updated on October 29 or later. Am I covered?
If your plugin shows 7.2.0 or higher, you have the fix. Plugin updates can be turned off or fail, so check the version.
Does the update change my PHP requirements?
No. The WordPress.org plugin files list PHP 7.0 as the minimum for both 7.1.1 and 7.2.0.
Is it being exploited?
We found no report that it is, and CISA does not list it. Patchstack expects it to be exploited, and the fix has been public since October 28. (Patchstack)
Where can I follow official updates?
Patchstack and the WordPress.org changelog. All current notices are on our notices page.
Security alerts by email
Hear about the next one first.
When a flaw puts websites at risk, we send one plain-English email: what happened, who it affects and what to do. It's free, whether or not you use EverThread.
Sources
- Patchstack: WordPress PDF Invoice Builder for WooCommerce Plugin <= 7.1.1 is vulnerable to a high priority Deserialization of untrusted data, October 30, 2026, checked October 31, 2026
- CVE Program: CVE-2026-109220, published October 31, 2026 by Wordfence, checked October 31, 2026
- GitHub Advisory Database: GHSA-5f8r-hw67-6cx4, published October 31, 2026, checked October 31, 2026
- NVD: CVE-2026-109220, published October 31, 2026, checked October 31, 2026
- WordPress.org: PDF Invoice for WooCommerce plugin page and changelog, version 7.2.0, checked October 31, 2026
- CISA: Known Exploited Vulnerabilities Catalog, catalog version dated October 30, 2026, checked October 31, 2026