Critical vulnerabilities
3 critical vulnerabilities in 3 WordPress plugins
3 vulnerabilities rated critical (CVSS 9.0 or higher) found on 31 October 2026: Remote code execution in WordPress plugins, Broken access control in WordPress plugins.
- 3 critical
Remote code execution in PDF Invoice for WooCommerce + Drag and Drop Template Builder · WordPress plugins
CVE-2026-109220
PDF Invoice for WooCommerce + Drag and Drop Template Builder <= 7.1.1 - Unauthenticated PHP Object Injection to Remote Code Execution via 'customer_note' Checkout Field
- Severity
- Critical 9.8
- Published
- 31 Oct 2026
| Software | Affected versions |
|---|---|
| PDF For Woocommerce (WordPress plugin)WordPress plugins |
|
- CVE.org https://www.cve.org/CVERecord?id=CVE-2026-109220
Broken access control in WP Booking System · WordPress plugins
CVE-2026-116557
WP Booking System <= 2.1.0.5 - Missing Authorization to Unauthenticated Arbitrary Calendar Note Deletion via wpbs_calendar_remove_note AJAX Action
- Severity
- Critical 9.1
- Published
- 31 Oct 2026
| Software | Affected versions |
|---|---|
| WP Booking System (WordPress plugin)WordPress plugins |
|
- CVE.org https://www.cve.org/CVERecord?id=CVE-2026-116557
Broken access control in Popup Builder · WordPress plugins
CVE-2026-89270
Popup Builder <= 4.4.5 - Missing Authorization to Unauthenticated Arbitrary Popup Post Trashing via 'post_type' and 'sg_popup_preview_id' Parameters
- Severity
- Critical 9.1
- Published
- 31 Oct 2026
| Software | Affected versions |
|---|---|
| Popup Builder (WordPress plugin)WordPress plugins |
|
- CVE.org https://www.cve.org/CVERecord?id=CVE-2026-89270
From NVD, the CVE Program, OSV.dev with the GitHub Advisory Database, WPVulnerability, WordPress's security advisories and CISA's Known Exploited Vulnerabilities catalog, as they stood when this was written. Each vulnerability's own page has its latest rating and fix. This product uses the NVD API but is not endorsed or certified by the NVD.