This vulnerability in WooCommerce PDF Invoice Builder (<=2.0.8) involves improper control over code generation, enabling remote attackers to perform code injection. The flaw allows execution of arbitrary code remotely without authentication or user interaction, leading to complete compromise of confidentiality, integrity, and availability of the affected system. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and scope change, with high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently provided.

Successful exploitation allows remote attackers to execute arbitrary code on the affected system, potentially leading to full system compromise including data theft, modification, or service disruption. The vulnerability affects confidentiality, integrity, and availability at the highest severity level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider disabling or removing the affected WooCommerce PDF Invoice Builder plugin (versions <=2.0.8) to prevent exploitation. Monitor vendor channels for updates and apply patches promptly once available.