CVE-2026-39472: WordPress WooCommerce PDF Invoices & Packing Slips plugin < 5.9.0 - PHP Object Injection vulnerability

Synopsis

PHP Object Injection in the WooCommerce PDF Invoices and Packing Slips WordPress plugin (versions before 5.9.0) allows an authenticated attacker with shop manager privileges to inject malicious PHP objects into the application. The vulnerability is reachable over the network and requires no victim interaction, but does require a high-privilege account to exploit. Successful exploitation gives the attacker full read, write, and availability control over the affected WordPress installation. A patched-image rebuild at version 5.9.0 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, so the attacker must be able to reach the WordPress installation via HTTP/HTTPS.

• AuthenticationRequired

  A shop manager account (or higher) is required; low-privilege subscriber-level accounts are not sufficient to trigger the injection.

• Victim interactionNot required

  No action from another user or administrator is needed to complete the attack.

• Attack complexityDetail

  Exploit conditions are straightforward and reliable, with no race conditions or special environmental dependencies required.

Blast Radius

• Reads any data accessible to the WordPress application, including stored order records, customer personally identifiable information, and payment-related metadata.
• Writes or modifies persisted database rows, including orders, user records, and plugin configuration.
• Can invoke arbitrary PHP object chains (POP gadgets) present in the application, potentially leading to remote code execution on the host server.
• Crashes or degrades the WordPress service if a destructive object chain is triggered during exploitation.