CVE-2026-39472

HighCVSS 7.2

Published: 15/06/2026(UTC)Updated: 15/06/2026(UTC)Translated: 16/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.45%

35th percentile - higher than 35% of all known CVEs

The WooCommerce PDF Invoices & Packing Slips plugin versions below 5.9.0 contain a PHP Object Injection vulnerability in the shop manager.

An attacker could exploit this vulnerability to execute malicious code, potentially leading to system compromise.

It is recommended to update the plugin to version 5.9.0 or later to mitigate this vulnerability.

Original NVD description (English source)

Shop manager PHP Object Injection in WooCommerce PDF Invoices & Packing Slips < 5.9.0 versions.