What is the CVSS score of EUVD-2026-36936?

EUVD-2026-36936 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of WooCommerce PDF Invoices & Packing Slips are affected by EUVD-2026-36936?

WooCommerce PDF Invoices & Packing Slips plugin versions prior to 5.9.0 contain a code execution vulnerability accessible to authenticated Shop Manager users, potentially enabling internal threat…. A patch is available.

How to fix or mitigate EUVD-2026-36936?

Within 24 hours: Catalog all WordPress installations running WooCommerce PDF Invoices & Packing Slips and document current versions. Within 7 days: Update all affected instances to version 5.9.0 or later. Within 30 days: Review Shop Manager account assignments, monitor authentication logs for anomalies, and verify successful plugin updates across all systems.

WooCommerce PDF Invoices & Packing Slips EUVD-2026-36936

| CVE-2026-39472 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-06-15 Patchstack

GHSA-jhg8-f96w-x397

PHP Deserialization WordPress Woocommerce Pdf Invoices Packing Slips

7.2

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.2 HIGH

Network-reachable WordPress endpoint (AV:N), straightforward serialized payload (AC:L), requires Shop Manager account (PR:H), no victim interaction (UI:N); object injection typically yields full C/I/A impact.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 15, 2026 - 22:30 vuln.today

Patch available

Jun 15, 2026 - 22:02 EUVD

CVE Published

Jun 15, 2026 - 20:17 cve.org

HIGH 7.2

DescriptionCVE.org

Shop manager PHP Object Injection in WooCommerce PDF Invoices & Packing Slips < 5.9.0 versions.

AnalysisAI

PHP Object Injection in the WooCommerce PDF Invoices & Packing Slips WordPress plugin before version 5.9.0 allows authenticated users with Shop Manager privileges to trigger unsafe deserialization, potentially leading to full compromise of confidentiality, integrity, and availability. The flaw was reported by Patchstack and a vendor patch is available, though no public exploit has been identified at time of analysis. The CVSS 7.2 score reflects high privilege requirements offset by network reach and severe impact.

Technical ContextAI

The vulnerability is rooted in CWE-502 (Deserialization of Untrusted Data), specifically PHP Object Injection - a class of bug that occurs when user-controllable input is passed to PHP's unserialize() function without sanitization. When suitable 'magic methods' (__wakeup, __destruct, __toString) exist in loaded classes or dependencies, an attacker can construct a serialized payload that instantiates arbitrary objects and triggers a POP (Property-Oriented Programming) chain on deserialization. The affected component is the WooCommerce PDF Invoices & Packing Slips plugin by WP Overnight (CPE cpe:2.3:a:wp_overnight:woocommerce_pdf_invoices_&_packing_slips), a widely deployed WordPress/WooCommerce extension that generates invoices and packing slips for orders; PHP object injection in such a plugin can leverage WordPress core or WooCommerce gadget chains to achieve file write or code execution.

RemediationAI

Vendor-released patch: upgrade the WooCommerce PDF Invoices & Packing Slips plugin to version 5.9.0 or later via the WordPress plugin dashboard or by replacing the plugin files from the official source, as documented in the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/woocommerce-pdf-invoices-packing-slips/vulnerability/wordpress-woocommerce-pdf-invoices-packing-slips-plugin-5-9-0-php-object-injection-vulnerability). Until the upgrade can be applied, restrict the Shop Manager role to a minimal set of trusted accounts, enforce strong authentication and MFA on all WooCommerce admin/shop-manager accounts, and audit recent shop-manager activity for unexpected order or invoice manipulation; deploying a WAF (Patchstack, Wordfence) with a virtual patch for this CVE can block known serialized payload patterns at the request layer, with the trade-off that custom or obfuscated payloads may bypass signature-based rules. Temporarily deactivating the plugin eliminates the attack surface entirely but breaks invoice and packing-slip generation, which may disrupt order fulfillment workflows.