WooCommerce PDF Invoice Builder CVE-2026-52704: Overview of a CVSS 10.0 Remote Code Execution Vulnerability

Introduction

A WordPress plugin used by over 2,000 WooCommerce stores to generate PDF invoices contains a code injection flaw rated CVSS 10.0, the maximum score. Any user with a basic Subscriber account can use it to execute arbitrary code on the server. The WooCommerce PDF Invoice Builder, developed by Edgar Rojas under the RedNao brand, reached version 2.0.9 on June 10, 2026 to address CVE-2026-52704. Every prior version through 2.0.8 remains vulnerable.

The WooCommerce PDF Invoice Builder (WordPress plugin slug: woo-pdf-invoice-builder) is a drag-and-drop template builder for PDF invoices, packing slips, and related documents in WooCommerce stores. It supports multi-language configurations via WPML and Polylang, QR codes, conditional logic, and password-protected PDFs. Its 2,000+ active installations are a relatively small footprint next to the larger WooCommerce invoice plugins. But the plugin runs on e-commerce sites, so any compromised site is one that handles payment data and customer personally identifiable information.

Technical Information

Vulnerability Classification

CVE-2026-52704 is classified under CWE-94: Improper Control of Generation of Code, commonly called "Code Injection." The NVD description specifies the attack as "Remote Code Inclusion," meaning the plugin dynamically includes or evaluates code from a source an attacker can influence. The Patchstack advisory places it under OWASP Top 10 category A3: Injection.

CWE-94 differs from command injection (CWE-77) in where the injected code runs. In a CWE-94 flaw, the application's own interpreter (here, PHP) executes the code, instead of the code being passed to an operating system shell. As the MITRE CWE definition notes, "code injection attacks can also lead to loss of data integrity in nearly all cases, since the control-plane data injected is always incidental to data recall or storage."

Related attack patterns documented for CWE-94 include CAPEC-242 (Code Injection), CAPEC-35 (Leveraging Executable Code in Non-Executable Files), and CAPEC-77 (Manipulating User-Controlled Variables).

Attack Surface and Exploitation Requirements

The low authentication requirement is what puts this vulnerability at CVSS 10.0. Exploitation needs only Subscriber-level privileges. In WordPress, Subscriber is the lowest authenticated role, and new user registrations typically get it by default. That matters for WooCommerce stores, where creating a customer account is a standard part of checkout. Any customer who has registered an account on a vulnerable store already has enough privileges to exploit the flaw.

The main parameters of the vulnerability:

Exploitation Mechanics

According to the Patchstack advisory, "this flaw could allow a malicious actor to execute commands on a target website to gain backdoor access and take full control." In a PHP/WordPress context, exploiting a CWE-94 vulnerability typically means getting user input to a code execution sink without adequate sanitization. Common PHP code execution sinks include eval(), include(), require(), assert(), and preg_replace() with the e modifier.

The MITRE CWE-94 documentation gives an example in which eval() processes input like __import__('subprocess').getoutput('rm -r *'). The example shows that a single unsanitized dynamic code evaluation call can escalate to arbitrary command execution.

As of the NVD publication date, the specific code path, vulnerable function, and parameter in WooCommerce PDF Invoice Builder that enable this Remote Code Inclusion have not been publicly disclosed. Withholding those details is consistent with coordinated disclosure practice. Researcher "she11f" reported the vulnerability to Patchstack on May 25, 2026, and it was published on June 15, 2026, about three weeks later.

Impact

A successful exploit lets the attacker execute arbitrary PHP code on the server. In most WordPress hosting environments, that amounts to full system compromise. Consequences include:

1. Deployment of web shells and persistent backdoors
2. Exfiltration of the WordPress database, including customer records, payment metadata, and administrator credentials
3. Modification of checkout flows to inject payment skimmers (Magecart-style attacks)
4. Lateral movement to other sites or services on shared hosting infrastructure
5. Use of the compromised server as infrastructure for further attacks

Affected Systems and Versions

The vulnerability affects the WordPress plugin "PDF Builder for WooCommerce. Create invoices, packing slips and more" (slug: woo-pdf-invoice-builder) in all versions from the initial release through version 2.0.8. Version 2.0.9, last modified on June 10, 2026, is the patched release.

Details of the affected software:

Any WordPress site running WooCommerce PDF Invoice Builder version 2.0.8 or earlier is affected. Sites that allow user registration (standard for WooCommerce stores) are at the highest risk, because on those sites the Subscriber role needed for exploitation is trivial to obtain.

The Patchstack advisory confirms that updating to version 2.0.9 or later resolves the vulnerability. For organizations that cannot update immediately, Patchstack also offers virtual patching as an interim measure. Other compensating controls include:

• Disabling user registration, so no new Subscriber accounts can be created
• Auditing and removing unnecessary low-privilege accounts
• Deploying WAF rules that target code injection patterns
• Segmenting the network to contain a potential compromise
• Enabling file integrity monitoring to detect post-exploitation activity early

Vendor Security History

The WooCommerce PDF Invoice Builder has a substantial history of security vulnerabilities. The following table summarizes known issues documented by Patchstack, Wordfence, and WPScan:

The plugin's changelog also records security fixes in earlier versions. The entry for version 1.2.114 reads "Fixed security issue in the pdf error resolver," and the entry for version 1.2.104 reads "Fixed CVE-2023-46076."

The progression from CSRF and XSS through broken access control to a full CVSS 10.0 RCE suggests systemic weaknesses in the plugin's input validation and authorization enforcement, not isolated coding errors. The plugin does participate in the Patchstack vulnerability disclosure program (Active VDP), which gives researchers a formal channel for reporting issues. Even so, given how often vulnerabilities are found in it and how their severity has escalated, organizations should consider whether continuing to use this plugin fits their risk tolerance.

Threat Landscape Context

As of the NVD publication date of June 15, 2026, no public sources confirm active exploitation of CVE-2026-52704 in the wild. The CVE has not appeared in the CISA Known Exploited Vulnerabilities Catalog.

Other WordPress plugin RCE vulnerabilities help in judging the risk. Several comparable vulnerabilities have been actively exploited in recent months:

• A critical vulnerability in the Funnel Builder plugin (affecting 40,000+ WooCommerce stores) was exploited to inject malicious JavaScript into checkout pages.
• CVE-2026-3300 in the Everest Forms Pro plugin was actively exploited to hijack vulnerable websites.
• CVE-2026-1357 in the WPvivid plugin allowed unauthenticated RCE, letting attackers upload PHP files and take over sites.

Three groups routinely target WordPress plugin RCE vulnerabilities:

• Automated botnets that scan for vulnerable installations and deploy web shells
• E-commerce skimmer operators running Magecart-style attacks against WooCommerce checkout flows
• Ransomware operators who use WordPress vulnerabilities for initial access

With a CVSS 10.0 score, a low authentication barrier, and deployment on e-commerce sites, this vulnerability likely leaves days rather than weeks for proactive patching before exploitation begins.

References

• NVD Entry for CVE-2026-52704
• Patchstack Advisory: Remote Code Execution (RCE) in WordPress WooCommerce PDF Invoice Builder Plugin
• WordPress.org Plugin Page: PDF Builder for WooCommerce
• MITRE CWE-94: Improper Control of Generation of Code
• Patchstack: WooCommerce PDF Invoice Builder Vulnerability History
• Wordfence: WooCommerce PDF Invoice Builder Vulnerability Timeline
• WPScan: PDF Builder for WooCommerce
• Wordfence: WooCommerce PDF Invoice Builder <= 1.2.148 CSRF
• Wordfence: WooCommerce PDF Invoice Builder <= 1.2.150 Missing Authorization
• Wordfence: PDF Builder for WooCommerce <= 1.2.136 Reflected XSS
• Patchstack: Broken Access Control in WooCommerce PDF Invoice Builder <= 1.2.150
• CISA Known Exploited Vulnerabilities Catalog