CVE-2026-109220 | addonsorg PDF Invoice for WooCommerce and Drag and Drop Template Builder Plugin Invoice Generation _getObjAttr deserialization

October 31, 2026 Yanac

A vulnerability was found in addonsorg PDF Invoice for WooCommerce and Drag and Drop Template Builder Plugin up to 7.1.1 on WordPress. It has been declared as critical. Affected by this vulnerability is the function _getObjAttr of the component Invoice Generation. Executing a manipulation of the argument customer_note can lead to deserialization.

The identification of this vulnerability is CVE-2026-109220. The attack may be launched remotely. There is no exploit available.VulDB Recent EntriesRead More