CVE-2026-52704 -- CVSS 10.0 Vulnerability Briefing
CVE-2026-52704 | CVSS 10.0 (Critical) | Exploit: No known exploit
What Is It
CVE-2026-52704 is a code injection vulnerability in the WooCommerce PDF Invoice Builder plugin for WordPress, developed by Edgar Rojas, which allows remote attackers to include and execute arbitrary code on affected installations.
Technical Detail
The flaw stems from improper control of code generation within the WooCommerce PDF Invoice Builder plugin, enabling Remote Code Inclusion (RCI). An attacker who can supply or manipulate input processed by the plugin's invoice generation functionality may inject external code references that the server subsequently fetches and executes. Successful exploitation results in full remote code execution (RCE) on the underlying web server, potentially granting complete control of the host, access to stored data, and a foothold into connected infrastructure.
Exploitation Status
No known exploit has been publicly documented or confirmed as of June 22, 2026. This vulnerability is not currently listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, and no proof-of-concept code has been identified in public repositories or threat intelligence feeds. Despite the absence of confirmed exploitation, the critical CVSS score of 10.0 warrants immediate attention given the low complexity typically associated with code injection vulnerabilities of this class.
Who Is Targeting This
Confirmed (ATTAX-verified): Lazarus Group (origin: DPRK, motivation: nation-state), APT29 (origin: Russia, motivation: nation-state), and TA577 (origin: unknown, motivation: unknown) have been confirmed as associated threat actors with high confidence. Reported (research-inferred): MOONSTONESLEET and LAZARUSGROUP have been identified through research-inferred attribution at medium confidence. It should be noted that MOONSTONESLEET and LAZARUSGROUP as reported actors may represent overlapping or alternate designations for the confirmed Lazarus Group cluster, though this has not been formally verified. Attribution to nation-state actors at this stage should be treated as contextual intelligence pending further corroboration.
What To Do
Organizations running the WooCommerce PDF Invoice Builder plugin should treat this as a priority patch given the maximum CVSS score and the nature of the vulnerability class. Administrators should immediately check the installed plugin version and apply any available update from the plugin developer or the WordPress plugin repository. If no patch is currently available, the recommended interim measure is to deactivate and remove the plugin until a fix is confirmed. Network-level controls should be reviewed to restrict outbound HTTP requests from the web server, which can limit the effectiveness of remote code inclusion attacks. Web application firewall (WAF) rules targeting file inclusion and code injection patterns should be enabled or tuned. Detection efforts should focus on anomalous outbound connections originating from the web server process, unexpected file writes in the WordPress directory structure, and server-side script execution from plugin-associated paths. Given the confirmed association with sophisticated nation-state actors, organizations in sectors commonly targeted by Lazarus Group and APT29 should treat this with elevated urgency and consider threat hunting across WordPress environments in their estate.