PT-2026-49237 · WordPress · Woocommerce Pdf Invoice Builder

She11F · CVE-2026-52704 · Published 2026-06-15 · Updated 2026-06-16

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WooCommerce PDF Invoice Builder versions prior to 2.0.9

Description Improper Control of Generation of Code allows Remote Code Inclusion, enabling an unauthenticated attacker to perform full code injection via remote file inclusion.

Recommendations Update to a version newer than 2.0.8.

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2026-52704

Affected Products

Woocommerce Pdf Invoice Builder

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-52704 · Security Note
• https://twitter.com/CCBalert/status/2066890758494290154 · Twitter Post
• https://patchstack.com/database/wordpress/plugin/woo-pdf-invoice-builder/vulnerability/wordpress-woocommerce-pdf-invoice-builder-plugin-2-0-8-remote-code-execution-rce-vulnerability?_s_id=cve · Note
• https://twitter.com/SecAlertsCo/status/2066529950174200040 · Twitter Post
• https://twitter.com/CVEnew/status/2066583777430663644 · Twitter Post
• https://t.me/CVEtracker/56870 · Telegram Post