WordPress Plugin Vulnerabilities

PDF Builder for WooCommerce < 2.0.9 - Subscriber+ Remote Code Execution

Description

The plugin is vulnerable to Remote Code Execution. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute code on the server.

Affects Plugins

Plugin icon
woo-pdf-invoice-builder
Fixed in 2.0.9

References

CVE
CVE-2026-52704
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/86ebb886-ad30-44e0-bed1-32d2ffefd50b

Classification

Type
RCE
OWASP top 10
A1: Injection
CWE
CWE-94
CVSS
8.8 (high)

Miscellaneous

Original Researcher
she11f
Verified
No
WPVDB ID
2606219f-2d51-4cd6-8aa6-e91d1017398b

Timeline

Publicly Published
2026-06-15 (about 1 month ago)
Added
2026-06-25 (about 1 month ago)
Last Updated
2026-07-24 (about 1 day ago)

Other

Published
Title
Published
2025-01-07
Title
WordPress File Upload < 4.25.0 - Unauthenticated Remote Code Execution, Arbitrary File Read, and Arbitrary File Deletion
Published
2025-12-08
Title
ProfilePress < 4.16.8 - Authenticated (Subscriber+) Arbitrary Shortcode Execution
Published
2025-10-21
Title
Stockie Extra < 1.2.12 - Unauthenticated Arbitrary Shortcode Execution
Published
2024-11-10
Title
WP Photo Album Plus < 8.9.01.001 - Unauthenticated Arbitrary Shortcode Execution via getshortcodedrenderedfenodelay
Published
2014-08-01
Title
DZS Video Gallery - ajax.php source Parameter Reflected XSS