EUVD-2026-36720
GHSA-p32f-9xm9-5fjr
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Unauthenticated network-reachable code injection in a WordPress plugin yields PR:N/UI:N/AC:L; RCE breaks out of the plugin sandbox into the host PHP process, justifying S:C with full C/I/A impact.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
Improper Control of Generation of Code ('Code Injection') vulnerability in Edgar Rojas WooCommerce PDF Invoice Builder allows Remote Code Inclusion.
This issue affects WooCommerce PDF Invoice Builder: from n/a through 2.0.8.
Articles & Coverage 1
AnalysisAI
Remote code execution in Edgar Rojas WooCommerce PDF Invoice Builder WordPress plugin (versions through 2.0.8) allows unauthenticated remote attackers to inject and execute arbitrary code on the host WordPress site. The CVSS 10.0 score with scope change reflects the severe impact: attackers can fully compromise the WordPress instance and potentially pivot beyond it. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions - remote unauthenticated exploitation against default configurations of any WordPress site with the WooCommerce PDF Invoice Builder plugin installed and active at version 2.0.8 or earlier. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This vulnerability ranks as critical-priority. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker identifies a WordPress site running WooCommerce PDF Invoice Builder ≤2.0.8 via fingerprinting (plugin readme.txt or asset URLs), then sends a crafted HTTP request to a vulnerable plugin endpoint that injects PHP code or includes a remote/attacker-controlled file. The injected code executes as the web server user, giving the attacker a webshell, the ability to exfiltrate the wp-config.php database credentials, and a foothold to drop persistence such as malicious admin users or backdoored plugin files. |
| Remediation | Upgrade WooCommerce PDF Invoice Builder to a version newer than 2.0.8 as soon as the vendor publishes a fixed release; the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/woo-pdf-invoice-builder/vulnerability/wordpress-woocommerce-pdf-invoice-builder-plugin-2-0-8-remote-code-execution-rce-vulnerability should be monitored for the exact patched version, as no fixed version was independently confirmed in the available data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Audit all WordPress instances to identify installations of Edgar Rojas WooCommerce PDF Invoice Builder through version 2.0.8 and determine network exposure. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today