CVE-2026-109220 - PDF Invoice for WooCommerce + Drag and Drop Template Builder <= 7.1.1 - Unauthenticated PHP Object Injection to Remote Code Execution via 'customer_note' Checkout Field

CVE ID :CVE-2026-109220 Published : Oct. 31, 2026, 7:16 a.m. | 44 minutes ago Description :The PDF Invoice for WooCommerce + Drag and Drop Template Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 7.1.1 via the 'customer_note' parameter...

#Sicherheitslücke

ARTICLEVIEW

CVE-2026-109220 - PDF Invoice for WooCommerce + Drag and Drop Template Builder <= 7.1.1 - Unauthenticated PHP Object Injection to Remote Code Execution via 'customer_note' Checkout Field

VERWANDTEARTIKEL

CVE-2026-76010 - Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 4.4.1 - Authenticated (Custom+) Remote Code Execution via XML-RPC 'meta_data' Mass Assignment and Path Traversal

CVE-2026-114217 - Konflux-ci: github token plaintext exposure in ci/cd scripts

CVE-2026-116086 - Konflux-ci: jq filter injection in github workflow issue management

CVE-2026-116964 - Konflux-ci: remote code execution via eval() in manifest scripts

CVE-2026-117681 - Konflux-ci: ui proxy skips backend tls verification on non-openshift clusters, leaking a token that can impersonate anyone

CVE-2026-118235 - SimpleForm <= 3.10.2 - Unauthenticated Arbitrary File Upload via Trailing-Dot Filename via Unknown File Key in simpleform_get_submit_data