Critical Remote Code Execution Vulnerability in WooCommerce PDF Invoice Builder Exposes Enterprise WordPress Sites

Overview

A high-severity code injection vulnerability (CVE-2026-52704) in the WooCommerce PDF Invoice Builder plugin for WordPress allows remote code execution with critical 10.0 CVSS impact. Unpatched systems face imminent risk of full infrastructure compromise.

Technical Analysis

The vulnerability arises from unchecked dynamic code generation in invoice templates, enabling attackers to inject and execute arbitrary PHP code via specially crafted invoice generation requests. Exploitation requires no authentication and can be triggered through the /invoice-builder endpoint using URL-encoded payloads. The flaw's reliability stems from improper input validation during template rendering, allowing attackers to bypass standard WordPress security filters. Successful exploitation grants full server access for lateral movement and persistent access establishment.

Enterprise & DIB Impact

Defense Industrial Base contractors and enterprises relying on WordPress for customer portals or e-commerce face existential risk, as breach could compromise sensitive operational data, CUI systems, and supply chain networks. The plugin's presence in 49,000+ WordPress installations expands the potential attack surface, including systems storing classified information under DIB requirements.

Recommended Actions

• Upgrade to WooCommerce PDF Invoice Builder 2.0.9 or later immediately
• disable plugin if not operationally required
• implement web application firewall rules blocking /invoice-builder endpoint requests
• conduct log analysis for suspicious code execution patterns
• employ runtime application self-protection tools for dynamic code monitoring