The vulnerability is an improper control of code generation that permits an attacker to inject and run arbitrary PHP code during the creation of PDF invoices by the WooCommerce PDF Invoice Builder plugin. This flaw, identified as CWE‑94, means that any user who can influence the invoice generation process could deliver malicious payloads that execute with the permissions of the WordPress process, allowing complete control over the affected website.

Any WordPress site running the WooCommerce PDF Invoice Builder plugin version 2.0.8 or earlier. The plugin, maintained by Edgar Rojas, is widely deployed to generate order invoices, and every release through 2.0.8 lacks the fix.

The CVSS score of 10 signals critical severity, while the EPSS score is currently unavailable, preventing a precise exploitation probability assessment. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack vector likely involves initiating PDF generation with crafted input, requiring the ability to create or edit invoices; once executed, injected code runs with WordPress process privileges, potentially compromising the entire site.