PDF Invoice for WooCommerce EUVD-2026-114594

Exploitable against a default install, but with concrete prerequisites drawn from the description: the store must have an offline payment gateway enabled that moves orders to 'on-hold' - specifically Direct Bank Transfer (BACS) or cheque - because that status transition is what fires the plugin's invoice-generation hook that reaches unserialize(). The malicious payload must be delivered in the customer_note checkout field via the public Store API checkout endpoint. The key limiting factor beyond this is that object injection converts to code execution only where an exploitable PHP POP gadget chain is loadable in the environment; without a suitable gadget the impact may be limited to object instantiation rather than full RCE. No authentication and no user interaction are required (PR:N/UI:N).

All exploitability signals point the same direction and are mutually consistent: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a remote, unauthenticated, low-complexity attack with no user interaction, and the description confirms the trigger is reachable on a default install via the public WooCommerce Store API - so this is not a theoretical high-CVSS flaw. The vuln.today Decision label is act_now, and Wordfence (the reporting source) classifies it as a critical PHP Object Injection reaching unserialize(). The one nuance: CWE-502 object injection yields reliable remote code execution only when a usable POP gadget chain is present in the plugin, WordPress core, or another loaded component; the description asserts code execution is possible, but whether a gadget chain ships by default is not demonstrated in the supplied evidence. No EPSS score and no CISA KEV entry are present in the input, so exploitation-probability and active-exploitation data are MISSING rather than negative - absence here does not downgrade priority given act_now plus an unauthenticated network path. Net: treat as a genuine high priority, with the single caveat that worst-case RCE hinges on gadget-chain availability not proven in these sources.

An unauthenticated attacker submits an anonymous WooCommerce checkout to the public Store API (POST /wc/store/v1/checkout) selecting Direct Bank Transfer or cheque, embedding a serialized PHP object payload in the customer_note field. The order auto-transitions to 'on-hold', firing the plugin's invoice-generation hook, which inlines the note into invoice HTML where mPDF/simplehtmldom reassembles it and passes it to unserialize(), instantiating attacker-controlled objects. No public exploit identified at time of analysis.