Pdf Invoice For Woocommerce Drag And Drop Template Builder
Monthly
Unauthenticated PHP object injection in the PDF Invoice for WooCommerce + Drag and Drop Template Builder plugin (all versions up to and including 7.1.1) lets remote attackers place an anonymous WooCommerce Store API checkout whose customer_note is carried verbatim into the generated invoice HTML and ultimately into unserialize() inside the bundled mPDF library, opening the path to server-side code execution. The described trigger works on a default install only when an offline gateway such as Direct Bank Transfer (BACS) or cheque is enabled, because the resulting 'on-hold' order status is what fires the invoice-generation hook; whether object injection escalates to full code execution depends on an exploitable PHP POP gadget chain being loadable in the target environment. No public exploit code was identified at time of analysis, but the vendor has shipped version 7.2.0 and the priority decision is act_now given the remote, unauthenticated, low-complexity profile reflected in the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N).
Unauthenticated PHP object injection in the PDF Invoice for WooCommerce + Drag and Drop Template Builder plugin (all versions up to and including 7.1.1) lets remote attackers place an anonymous WooCommerce Store API checkout whose customer_note is carried verbatim into the generated invoice HTML and ultimately into unserialize() inside the bundled mPDF library, opening the path to server-side code execution. The described trigger works on a default install only when an offline gateway such as Direct Bank Transfer (BACS) or cheque is enabled, because the resulting 'on-hold' order status is what fires the invoice-generation hook; whether object injection escalates to full code execution depends on an exploitable PHP POP gadget chain being loadable in the target environment. No public exploit code was identified at time of analysis, but the vendor has shipped version 7.2.0 and the priority decision is act_now given the remote, unauthenticated, low-complexity profile reflected in the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N).