CVE-2026-39472: WooCommerce PDF Invoices PHP Object Injection RCE Vulnerability

Technical summary

CVE-2026-39472 is a PHP Object Injection vulnerability (CWE-502) affecting WooCommerce PDF Invoices & Packing Slips versions prior to 5.9.0. The flaw allows a shop manager—an authenticated user with elevated permissions—to inject malicious serialized PHP objects through an unvalidated input vector. Upon deserialization, the injected objects can trigger magic methods and gadget chains that lead to arbitrary code execution with server-level privileges. The attack surface is limited to authenticated users with shop manager role or higher, significantly reducing opportunistic attack risk but raising concern for insider threats and compromised admin accounts.

Business impact

Successful exploitation allows attackers to execute arbitrary PHP code within the WordPress environment, enabling full site compromise. Potential impacts include theft of customer payment data, modification or deletion of orders, injection of malicious content into invoices or packing slips sent to customers, database manipulation, and lateral movement into backend systems. For e-commerce operations relying on WooCommerce, this creates both direct financial exposure (fraudulent transactions, data breach liability) and reputational damage through compromised customer communications.

Affected systems

WordPress installations running WooCommerce PDF Invoices & Packing Slips plugin in versions below 5.9.0. Affected deployments are primarily small-to-medium e-commerce sites and enterprises using WooCommerce for order management. The vulnerability requires an attacker to have or obtain shop manager credentials, making compromised admin accounts, insider threats, or social engineering the primary attack vectors.

Exploitability

While the vulnerability is technically exploitable and carries high impact, real-world exploitation barriers are meaningful: the attacker must first authenticate as a shop manager or higher. Attack complexity is low once access is obtained—the injection payload is straightforward to craft. The CVSS 3.1 score of 7.2 (HIGH) reflects the combination of high impact and privilege requirement. This is not an unauthenticated remote code execution and will not appear on public exploit databases as a priority target for mass scanning. However, targeted attacks against compromised admin accounts or insider abuse represent credible threats.

Remediation

Immediately update WooCommerce PDF Invoices & Packing Slips to version 5.9.0 or later. Verify the update through the WordPress plugin dashboard or the official plugin repository. In parallel, audit shop manager and administrator account activity, force password resets for all admin users, and review recent changes to invoices or packing slip templates for signs of tampering. Implement principle of least privilege: restrict shop manager roles to users who genuinely require them, and consider using role management plugins to further compartmentalize capabilities.

Patch guidance

Patches are available in WooCommerce PDF Invoices & Packing Slips version 5.9.0 and later. Deployment is straightforward via the WordPress admin panel: navigate to Plugins > Installed Plugins, locate the plugin, and click 'Update'. Test the update on a staging environment first to ensure invoice generation and packing slip rendering remain functional. Verify compatibility with your active WordPress and WooCommerce versions before production deployment. Check the official plugin changelog to confirm the fix addresses object injection handling.

Detection guidance

Monitor for signs of exploitation: unusual database queries in WordPress debug logs, unexpected changes to invoice or packing slip templates, new user accounts with admin privileges, authentication from unfamiliar IP addresses to shop manager accounts, and filesystem modifications outside the normal plugin directory. Review web server access logs for suspicious POST requests to invoice or packing slip processing endpoints. Implement file integrity monitoring on the plugin directory to detect runtime code injection. Check PHP error logs for deserialization warnings or notices in the invoice/packing slip processing code paths.

Why prioritize this

Treat as HIGH priority due to the combination of (1) arbitrary code execution impact, (2) access to sensitive e-commerce data, (3) potential for customer trust damage, and (4) ease of lateral movement once compromised. However, recognize that privilege requirement (shop manager minimum) reduces mass exploitation likelihood compared to unauthenticated RCE flaws. Prioritize remediation for sites with high-value customer bases, high transaction volumes, or known sensitive payment data handling. Sites with strong access controls and regular admin audits can sequence this slightly lower than critical patches, but no delays beyond 2 weeks are defensible.

Risk score, explained

CVSS 3.1 score of 7.2 (HIGH) is justified: Network-accessible (AV:N), low attack complexity (AC:L), high privilege requirement (PR:H), unchanged scope (S:U), and all impact metrics at high (C:H/I:H/A:H). The privilege barrier prevents this from reaching CRITICAL, but the breadth of potential impact—confidentiality, integrity, and availability of the entire WordPress instance—places it solidly in HIGH. For e-commerce environments where the plugin is in active use, apply an internal severity multiplier based on customer data exposure and transaction volume.

Frequently asked questions