Paper/Archive/CVE-2026-52704

CVE-2026-52704

Edgar Rojas WooCommerce PDF Invoice Builder — WordPress WooCommerce PDF Invoice Builder plugin <= 2.0.8 - Remote Code Execution (RCE) vulnerability

EPSS 0.3%CVSS 10.0

critical.is priorityof 100

CVSS 10.0 (CNA)10.0 / 10 × 3030.0 Not in CISA KEV+300.0 EPSS percentile 23.3.233 × 204.7 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

Improper Control of Generation of Code ('Code Injection') vulnerability in Edgar Rojas WooCommerce PDF Invoice Builder allows Remote Code Inclusion. This issue affects WooCommerce PDF Invoice Builder: from n/a through 2.0.8.

Affected

ProductAffectedFixed inSource

WooCommerce PDF Invoice Buildern/a – 2.0.8–CNA

Scores by source

Patchstack (CNA)10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refpatchstack.com/database/wordpress/plugin/woo-pdf-invoice-builder/vulnerability/wordpress-woocommerce-pdf-invoice-builder-plugin-2-0-8-remote-code-execution-rce-vulnerability?_s_id=cve