CVE-2026-39472: WooCommerce PDF Invoices PHP Injection

CVE-2026-39472 Overview

CVE-2026-39472 is a PHP Object Injection vulnerability in the WooCommerce PDF Invoices & Packing Slips plugin for WordPress. The flaw affects all plugin versions prior to 5.9.0. Attackers authenticated as a Shop Manager can supply crafted serialized input that the plugin deserializes without validation. The issue is tracked under [CWE-502: Deserialization of Untrusted Data].

Successful exploitation can compromise the confidentiality, integrity, and availability of the WordPress site. The vulnerability requires high privileges but no user interaction, and it is exploitable over the network.

Critical Impact
An authenticated Shop Manager can trigger PHP object injection to escalate privileges, execute arbitrary code through gadget chains, or tamper with store data.

Affected Products

WooCommerce PDF Invoices & Packing Slips plugin for WordPress
All versions prior to 5.9.0
WordPress sites running WooCommerce with this plugin installed

Discovery Timeline

2026-06-15 - CVE-2026-39472 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-39472

Vulnerability Analysis

The vulnerability resides in the WooCommerce PDF Invoices & Packing Slips plugin, which deserializes attacker-controlled input without sufficient validation. PHP Object Injection occurs when untrusted data reaches unserialize() or an equivalent deserialization routine. Once instantiated, attacker-defined objects can invoke magic methods such as __wakeup(), __destruct(), or __toString().

When combined with available gadget chains in WordPress core, WooCommerce, or other installed plugins, this primitive can lead to arbitrary file writes, SQL execution, or remote code execution. The exploit requires Shop Manager privileges, limiting the attack surface to accounts that already possess elevated store-management rights.

Root Cause

The root cause is improper handling of serialized data within plugin functionality accessible to Shop Manager roles. The plugin passes user-supplied or store-derived data into PHP deserialization routines without enforcing allow-list class restrictions. This matches the CWE-502 pattern.

Attack Vector

An attacker with Shop Manager credentials submits a crafted serialized payload through a plugin entry point that handles invoice or packing slip data. The server deserializes the payload, instantiating arbitrary PHP objects. These objects trigger gadget chains in the installed code base, allowing the attacker to execute code or modify site data under the WordPress process context.

The vulnerability can be reached over the network through standard WordPress admin requests. No user interaction is required beyond the authenticated attacker's own session. Refer to the Patchstack Vulnerability Advisory for technical details.

Detection Methods for CVE-2026-39472

Indicators of Compromise

Unexpected serialized PHP payloads (strings beginning with O:, a:, or s:) submitted to WordPress admin or AJAX endpoints associated with the WooCommerce PDF Invoices & Packing Slips plugin
Unusual file writes within wp-content/uploads/ or plugin directories shortly after Shop Manager authenticated sessions
New or modified PHP files in wp-content/ that did not originate from a tracked plugin update
Outbound network connections initiated by the php-fpm or web server process to unfamiliar hosts following Shop Manager activity

Detection Strategies

Monitor WordPress access and audit logs for Shop Manager accounts submitting requests containing serialized object markers to plugin endpoints
Inspect PHP error logs for warnings from unserialize(), including __PHP_Incomplete_Class references and class instantiation failures
Correlate plugin version inventory against 5.9.0 to identify exposed installations
Apply web application firewall rules that flag serialized PHP payloads in POST bodies and query strings

Monitoring Recommendations

Audit all WordPress accounts with the Shop Manager role and verify continued business need
Log and review file integrity for wp-content/plugins/woocommerce-pdf-invoices-packing-slips/ and related directories
Enable detailed PHP logging in production to capture deserialization anomalies
Track outbound connections from web tier hosts to detect post-exploitation command-and-control activity

How to Mitigate CVE-2026-39472

Immediate Actions Required

Upgrade the WooCommerce PDF Invoices & Packing Slips plugin to version 5.9.0 or later
Review and reduce the number of accounts assigned the Shop Manager role
Rotate credentials for all Shop Manager accounts and enforce multi-factor authentication
Audit the WordPress installation for unauthorized files, scheduled tasks, and admin users created since the plugin was installed

Patch Information

The vendor released a fixed version 5.9.0 that resolves the PHP Object Injection issue. Site operators should update the plugin through the WordPress admin interface or by deploying the updated plugin package. Confirm remediation by checking the plugin version under Plugins → Installed Plugins after the update. See the Patchstack Vulnerability Advisory for vendor references.

Workarounds

If immediate patching is not possible, deactivate the WooCommerce PDF Invoices & Packing Slips plugin until the update is applied
Restrict access to /wp-admin/ using IP allow-lists or VPN-only access for administrative roles
Deploy a web application firewall rule that blocks serialized PHP object payloads from reaching plugin endpoints
Temporarily downgrade Shop Manager accounts to lower-privilege roles where store operations permit

bash

# Configuration example: WP-CLI update to patched version
wp plugin update woocommerce-pdf-invoices-packing-slips --version=5.9.0
wp plugin get woocommerce-pdf-invoices-packing-slips --field=version