The PDF Invoice for WooCommerce + Drag and Drop Template Builder plugin, published by addonsorg, contains a flaw rated 9.8 out of 10 by the NVD. If your online store runs a version at or below 7.1.1, back up first, then update the plugin or disable it temporarily. One caveat applies: the available sources list no fixed version, so this should be confirmed directly with the publisher.
What is it?
The software that generates your store’s PDF invoices does not adequately filter text entered by a visitor, and that text can be treated as a command by the server.
A plugin is software added to a WordPress site to give it an extra function, here generating PDF invoices. According to the NVD listing, a free-text field filled in during checkout is not filtered enough before being reused in the invoice: its content can then cause the server, the computer hosting your site, to execute instructions coming from outside.
It’s a bit like a cottage closed up for winter with the key left under the mat: everything looks locked, but anyone who knows the habit walks in without forcing anything. Here, no account or password is needed. The NVD listing states that a default installation is enough and that the attacker does not need to be authenticated, meaning recognized by the site.
Why is it serious?
Executing code on the server amounts to taking control of the store: the site, order history, and customer information become accessible.
The NVD listing reports a CVSS 3.1 score of 9.8 out of 10, assigned by the reporting organization (CNA). CVSS is the international severity scale, and 9.8 sits near the top. The flaw was published on October 31, 2026; no exploitation is reported in the NVD listing as of this review. The ease of access described is enough to justify acting quickly.
In business terms: a site going down, interrupted orders, customer details possibly exposed. For an organization in Quebec, a personal information leak triggers specific obligations. Among them: keeping a register of confidentiality incidents and, when a risk of serious harm is established, notifying the Commission d’accès à l’information (Quebec’s privacy regulator) and the affected individuals.
Who is affected?
WordPress sites that sell through WooCommerce and use this PDF invoice plugin in a version up to and including 7.1.1.
The NVD listing does not specify a fixed version: the publisher addonsorg or the plugin’s official page on WordPress.org can confirm this. In practice, this covers retailers and garages selling parts online. It also includes producers who sell part of their harvest online, clinics, and neighborhood shops.
How do I check my business?
The plugin list in the site’s dashboard shows whether it is present and which version is installed.
- Ask your IT provider to open the plugin list and record the installed version.
- Have the publisher confirm which version fixes the flaw, since the NVD listing does not provide one.
- Ask your host to keep and review the site’s logs for unusual activity since October 31, 2026.
- Confirm that a full backup of the site and its database exists and has already been tested.
Some vocabulary: site logs are the record the server keeps on its own (who came, when, and what); the database is the cabinet where the site stores products, orders, and customer accounts.
Scenario
Fictional example: a regional garage selling parts online had not applied the update.
On Monday morning, the site stops responding and invoices no longer come out. The web developer finds that the server has been altered; the store stays closed while a backup is restored and access credentials are changed. The front counter works on paper, weekend orders have to be re-entered, and customer details may have been accessed.
What to do now
- Back up the site and its database, then verify that the backup can actually be restored.
- Check the plugin’s version against the 7.1.1 threshold listed in the NVD entry.
- Update to the fixed version once confirmed by the publisher, or disable the plugin and arrange a temporary way to issue invoices.
- Update other plugins, strengthen admin passwords, then log the check and its date in your internal records.
FAQ
Should we close the store in the meantime?
This decision should be confirmed with whoever manages the site rather than assumed. Disabling the invoicing plugin removes the function in question, but the effect on the rest of the online store depends on your setup: that needs to be checked, along with a plan for invoicing in the meantime.
How do we know if we’ve already been targeted?
Reviewing the site and server logs is the main avenue, if they are still available. It may surface unusual activity without always allowing a firm conclusion: incomplete or deleted logs don’t settle the question either way. No exploitation is reported in the NVD listing as of this writing.
Are we too small to be a target?
No. Vulnerable sites are identified automatically, regardless of revenue or sector: a neighborhood shop and a national company look the same in a scan. Updating sharply reduces exposure without resolving everything else, and no protection is absolute: be wary of claims promising zero risk.
Sources
- CVE-2026-109220 listing from the National Vulnerability Database · NIST, October 31, 2026
- Canadian Centre for Cyber Security: baseline cyber security controls for small and medium organizations · baseline reference checklist
- Commission d’accès à l’information du Québec · obligations, incident register, and notification
Source: NVD (NIST) · https://nvd.nist.gov/vuln/detail/CVE-2026-109220
This article was prepared by RISS Canada’s monitoring team from the public sources cited above, with the assistance of AI tools, then reviewed according to our editorial standards.
