What is the CVSS score of EUVD-2026-36720?

EUVD-2026-36720 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of WooCommerce PDF Invoice Builder are affected by EUVD-2026-36720?

The Edgar Rojas WooCommerce PDF Invoice Builder plugin (versions through 2.0.8) contains an unauthenticated remote code execution vulnerability that could allow attackers to fully compromise…

How to fix or mitigate EUVD-2026-36720?

Within 24 hours: Audit all WordPress instances to identify installations of Edgar Rojas WooCommerce PDF Invoice Builder through version 2.0.8 and determine network exposure. Within 7 days: Either disable the plugin immediately if operationally feasible, or implement WAF rules to block requests to vulnerable endpoints and restrict WordPress admin access to known IP ranges. Within 30 days: Monitor vendor advisory channels for patch availability; if no update emerges within 30 days, migrate to an alternative PDF invoice generation plugin from an actively maintained vendor.

WooCommerce PDF Invoice Builder EUVD-2026-36720

| CVE-2026-52704 CRITICAL

Code Injection (CWE-94)

2026-06-15 Patchstack

GHSA-p32f-9xm9-5fjr

Code Injection WordPress RCE Woocommerce Pdf Invoice Builder

10.0

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

10.0 CRITICAL

Unauthenticated network-reachable code injection in a WordPress plugin yields PR:N/UI:N/AC:L; RCE breaks out of the plugin sandbox into the host PHP process, justifying S:C with full C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 15, 2026 - 14:31 vuln.today

CVE Published

Jun 15, 2026 - 12:49 cve.org

CRITICAL 10.0

DescriptionCVE.org

Improper Control of Generation of Code ('Code Injection') vulnerability in Edgar Rojas WooCommerce PDF Invoice Builder allows Remote Code Inclusion.

This issue affects WooCommerce PDF Invoice Builder: from n/a through 2.0.8.

Articles & Coverage 1

News Critical RCE in WordPress WooCommerce PDF Invoice Builder Plugin - CVE-2026-52704 Jun 15, 2026

AnalysisAI

Remote code execution in Edgar Rojas WooCommerce PDF Invoice Builder WordPress plugin (versions through 2.0.8) allows unauthenticated remote attackers to inject and execute arbitrary code on the host WordPress site. The CVSS 10.0 score with scope change reflects the severe impact: attackers can fully compromise the WordPress instance and potentially pivot beyond it. No public exploit identified at time of analysis, but the trivial attack vector (AV:N/AC:L/PR:N/UI:N) makes mass exploitation likely once details surface.

Technical ContextAI

The vulnerability is rooted in CWE-94 (Improper Control of Generation of Code), specifically manifesting as Remote Code Inclusion - a class where user-controlled input influences which code file or payload is loaded and executed by the PHP runtime. The affected component is the WooCommerce PDF Invoice Builder plugin (CPE cpe:2.3:a:edgar_rojas:woocommerce_pdf_invoice_builder), a third-party WordPress extension used to generate PDF invoices for WooCommerce stores. PDF generation workflows commonly involve template rendering, file inclusion, or eval-style execution paths, any of which - if reachable with attacker-controlled input - provide a direct path to arbitrary PHP execution within the WordPress process context.

RemediationAI

Upgrade WooCommerce PDF Invoice Builder to a version newer than 2.0.8 as soon as the vendor publishes a fixed release; the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/woo-pdf-invoice-builder/vulnerability/wordpress-woocommerce-pdf-invoice-builder-plugin-2-0-8-remote-code-execution-rce-vulnerability should be monitored for the exact patched version, as no fixed version was independently confirmed in the available data. If a patched release is not yet available, deactivate and remove the plugin entirely until a fix ships - invoices can be regenerated later, but a compromised WordPress instance is far more costly. Compensating controls include placing a WAF (e.g., Patchstack, Wordfence virtual patching) in front of the site to block code-injection patterns targeting the plugin's endpoints, restricting access to plugin URLs to authenticated administrative IPs via web server ACLs (side effect: breaks any customer-facing invoice download flows), and enabling PHP open_basedir / disable_functions hardening to limit post-exploitation reach (side effect: may break other plugins relying on those functions).