CVE-2026-52704: WordPress WooCommerce PDF Invoice Builder plugin <= 2.0.8 - Remote Code Execution (RCE) vulnerability

Synopsis

This is a code injection (remote code execution) vulnerability in the WooCommerce PDF Invoice Builder WordPress plugin, affecting all versions through 2.0.8. The flaw is reachable over the network with no authentication required and no user interaction needed, making it trivially exploitable from the public internet. Successful exploitation gives an attacker full control over the host server, including the ability to read, modify, or destroy all data and crash the service. HarborGuard is tracking the upstream advisory and will make a patched-image rebuild available the moment a fix version is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable plugin endpoint is exposed over the network, so an attacker must be able to reach the WordPress installation via HTTP/HTTPS from any internet-connected location.

• AuthenticationNot required

  No account or session credential of any kind is needed; the injection endpoint is accessible to unauthenticated requests.

• Victim interactionNot required

  The attacker does not need to trick any user into performing an action; exploitation is fully server-side.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and imposes no special preconditions such as race conditions or specific memory layouts.

Blast Radius

• The attacker can execute arbitrary server-side code with the privileges of the web server process, effectively taking full control of the host.
• All files readable by the web server, including WordPress configuration files containing database credentials and secret keys, are exposed.
• The attacker can write, overwrite, or delete any file accessible to the web server process, including theme files, plugin files, and uploaded customer documents.
• The web server process can be crashed or the underlying service disrupted, taking the WordPress storefront and all WooCommerce operations offline.