CVE-2026-39472 is a CWE-502 vulnerability involving deserialization of untrusted data in the WooCommerce PDF Invoices & Packing Slips plugin by WP Overnight. Specifically, shop managers can exploit PHP Object Injection in versions prior to 5.9.0, allowing them to execute arbitrary code or manipulate application state. The vulnerability has a CVSS 3.1 base score of 7.2, indicating high severity with network attack vector, low attack complexity, requiring high privileges but no user interaction, and impacts confidentiality, integrity, and availability. No patch or official remediation level has been disclosed as of the published date.

Successful exploitation allows an attacker with shop manager privileges to perform PHP Object Injection via deserialization of untrusted data, potentially leading to full compromise of the affected system's confidentiality, integrity, and availability. This could enable arbitrary code execution or unauthorized data manipulation within the context of the vulnerable plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict shop manager privileges to trusted users only and monitor for suspicious activity related to the plugin. Avoid importing or processing untrusted serialized data within the plugin's context.