Code Injection in WooCommerce PDF Invoice Builder Plugin

Improper Control of Generation of Code ('Code Injection') vulnerability in Edgar Rojas WooCommerce PDF Invoice Builder allows Remote Code Inclusion. This issue affects WooCommerce PDF Invoice Builder: from n/a through 2.0.8.

Casky was already ahead

This CVE exploits attack patterns that Casky's 301matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The WooCommerce PDF Invoice Builder plugin (versions through 2.0.8) contains a critical code injection vulnerability that allows attackers to execute arbitrary code remotely. This CWE-94 vulnerability stems from improper control over code generation, enabling threat actors to inject and execute malicious code within the context of affected WordPress installations. Any organization running this popular e-commerce plugin—particularly those processing sensitive payment and invoice data—faces immediate risk of complete system compromise, data exfiltration, and malware deployment.

Casky's 301 matching security skills leverage Claude's extended reasoning to map attack chains across MITRE ATT&CK's Initial Access (TA0001) and Resource Development (TA0043) phases. Practitioners using Casky would observe detection findings that correlate suspicious code generation patterns with exploitation attempts, identify anomalous invoice processing requests containing embedded payloads, and flag unusual file inclusions or dynamic code execution within the plugin's processing pipeline. The platform's skill mapping would highlight how attackers transition from resource reconnaissance through weaponized invoice parameters, enabling security teams to implement layered detection—from Web Application Firewalls blocking malicious invoice inputs to endpoint monitoring alerting on unexpected code execution spawned by PHP processes.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

301 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-52704.

analyzing-apt-group-with-mitre-navigator

threat intelligence · low

Run

analyzing-campaign-attribution-evidence

threat intelligence · low

Run

analyzing-certificate-transparency-for-phishing

threat intelligence · low

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-52704

Casky has 301 skills that investigate the attack patterns behind CVE-2026-52704. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn