WooCommerce PDF Invoice Builder vulnerabilities

CVE-2026-52704 describes an improper control of code generation vulnerability in WooCommerce PDF Invoice Builder, allowing for remote code inclusion. This issue affects versions from n/a through 2.0.8.

The WooCommerce PDF Invoice Builder plugin for WordPress (versions up to 2.0.8) exposes sensitive system information to unauthorized entities, allowing retrieval of embedded sensitive data.

Missing Authorization vulnerability in EDGARROJAS WooCommerce PDF Invoice Builder woo-pdf-invoice-builder allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WooCommerce PDF Invoice Builder: from n/a through <= 1.2.150.

The WooCommerce PDF Invoice Builder for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the GetInvoiceDetail function in versions up to and including 1.2.89. This allows subscribers to view arbitrary invoices if they can guess the order id and invoice id.

The WooCommerce PDF Invoice Builder for WordPress is vulnerable to Cross-Site Request Forgery due to a missing nonce check on the SaveCustomField function in versions up to and including 1.2.90. This allows unauthenticated attackers to create invoice fields if they can trick an admin into performing an action such as clicking on a link.