CVE-2026-103769
WordPress PDF Invoices and Packing Slips For WooCommerce plugin <= 1.4.10 - PHP Object Injection vulnerability
- High 7.2
Description
Deserialization of Untrusted Data vulnerability in Acowebs PDF Invoices and Packing Slips For WooCommerce pdf-invoices-and-packing-slips-for-woocommerce allows Object Injection.This issue affects PDF Invoices and Packing Slips For WooCommerce: from n/a through 1.4.10.
Key facts
- Published
- 13 Nov 2026
- Last changed
- 13 Nov 2026
- Assigned by
- Patchstack
- EPSS
- 0.469% likely to be exploited in the next 30 days, higher than 41.128% of CVEs (scores for 15 Nov 2026)
- SSVC (CISA)
- Exploitation: none; Automatable: no; Technical impact: total
Severity scores
Each score is shown as its source gave it. They are not averaged or merged.
- 7.2CVSS 3.1, Highfrom the CNA (Patchstack)
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
What to do
- Update the WordPress PDF Invoices and Packing Slips For WooCommerce plugin to the latest available version (at least 1.4.11).CNA solution statement
Historical context and remediation
This reference retains the original CVE publication date. A recent record update does not mean a new attack occurred.
Object Injection (CNA impact statement)
Version statuses below come from the CNA. An “unaffected” version is not necessarily a currently supported release or proof of a patch date. EPSS is a dated risk estimate, not a count of historical attacks.
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Acowebs | PDF Invoices and Packing Slips For WooCommerce |
|
Timeline
- 13 Nov 2026 Published