CVE-2026-52704

Vulnerability

The WooCommerce PDF Invoice Builder plugin for WordPress versions through 2.0.8 contains a code injection vulnerability (CWE-94) that allows the generation of arbitrary code. The flaw resides in improper control of code generation, enabling remote code inclusion without authentication [1].

Exploitation

An unauthenticated remote attacker can exploit this by sending a crafted request to the vulnerable plugin, injecting malicious code that gets executed on the server. No user interaction or prior authentication is required [1].

Impact

Successful exploitation grants the attacker the ability to execute arbitrary commands on the target website, potentially leading to full compromise of the site, including data theft, backdoor installation, and lateral movement [1].

Mitigation

The vulnerability is fixed in version 2.0.9 of the plugin. Users should immediately update to this version or later. Patchstack has also released a virtual mitigation rule to block attacks until the update is applied [1].