WordPress WooCommerce PDF Invoice Plugin PHP Object Injection Vulnerability

The PDF Invoice for WooCommerce + Drag and Drop Template Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to and including 7.1.1.

The customer_note checkout field is insufficiently sanitized: it is inlined verbatim into invoice HTML, entity-decoded back into a live tag by simplehtmldom, reassembled into raw bytes by mPDF, and passed to unserialize() in _getObjAttr without validation.

• Affected versions: all versions up to and including 7.1.1
• Attackers: unauthenticated
• Impact: arbitrary code execution on the server
• Trigger: anonymous WooCommerce checkout via the public Store API (POST /wc/store/v1/checkout) using a Direct Bank Transfer or cheque payment method, which transitions the order to on-hold status and fires the plugin's invoice-generation hook