CVE-2026-52704: Edgar Rojas Woocommerce PDF Invoice Builder

Critical severity, CVSS 10.0. EPSS: 0.6% chance of exploitation in the next 30 days.

Improper Control of Generation of Code ('Code Injection') vulnerability in Edgar Rojas WooCommerce PDF Invoice Builder allows Remote Code Inclusion. This issue affects WooCommerce PDF Invoice Builder: from n/a through 2.0.8.

Affected products

• Edgar Rojas Woocommerce PDF Invoice Builder: up to and including 2.0.8

Published 2026-06-15. Last modified 2026-06-17.