Technical impact
This vulnerability stems from the plugin’s deserialization of untrusted data, which enables object injection. An attacker can manipulate serialized input to create arbitrary PHP objects, potentially leading to remote code execution or unauthorized modification of data. The weakness is classified as CWE-502, making it possible for a malicious actor to bypass server‑side validation and execute arbitrary code.
Affected Systems
The flaw exists in the Acowebs PDF Invoices and Packing Slips For WooCommerce plugin for WordPress. Versions from the initial release through 1.4.10 are affected; upgrading to 1.4.11 or later removes the flaw.
Risk and Exploitability
The CVSS score of 7.2 indicates a high severity, while the EPSS score is not provided, leaving the exploitation probability unclear. The vulnerability is not listed in the CISA KEV catalog. Because the plugin operates within the WordPress web application, the likely attack vector is via HTTP requests that trigger the vulnerable serialization code. An attacker with sufficient access to supply crafted data can exploit the flaw to gain arbitrary code execution on the server.
