CVE-2026-52704
CriticalCVSS 10.0Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
CVE-2026-52704 describes an improper control of code generation vulnerability in WooCommerce PDF Invoice Builder, allowing for remote code inclusion. This issue affects versions from n/a through 2.0.8.
Risk Assessment
Remote code inclusion can lead to system takeover, posing a serious security threat to the organization. Attackers may exploit this vulnerability to execute malicious code on the server.
Recommendation
It is recommended to update WooCommerce PDF Invoice Builder to the latest version to mitigate this vulnerability. A security audit of the system should also be conducted to identify potential exploits.
Other vulnerabilities in WooCommerce PDF Invoice Builder
See all- CVE-2026-57393Medium
The WooCommerce PDF Invoice Builder plugin for WordPress (versions up to 2.0.8) exposes sensitive system information to unauthorized entities, allowing retrieval of embedded sensitive data.
- CVE-2023-4245Medium
The WooCommerce PDF Invoice Builder for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the GetInvoiceDetail function in versions up to and including 1.2.89. This allows subscribers to view arbitrary invoices if they can guess the order id and invoice id.
- CVE-2023-4161Medium
The WooCommerce PDF Invoice Builder for WordPress is vulnerable to Cross-Site Request Forgery due to a missing nonce check on the SaveCustomField function in versions up to and including 1.2.90. This allows unauthenticated attackers to create invoice fields if they can trick an admin into performing an action such as clicking on a link.
Original NVD description (English source)
Improper Control of Generation of Code ('Code Injection') vulnerability in Edgar Rojas WooCommerce PDF Invoice Builder allows Remote Code Inclusion. This issue affects WooCommerce PDF Invoice Builder: from n/a through 2.0.8.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS