cbcvebase.
CVE-2025-13773
published 2025-12-24

CVE-2025-13773: The Print Invoice & Delivery Notes for WooCommerce plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 5.8.0 via…

PriorityP183critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
3.20%
86.5th percentile
The Print Invoice & Delivery Notes for WooCommerce plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 5.8.0 via the 'WooCommerce_Delivery_Notes::update' function. This is due to missing capability check in the 'WooCommerce_Delivery_Notes::update' function, PHP enabled in Dompdf, and missing escape in the 'template.php' file. This makes it possible for unauthenticated attackers to execute code on the server.

Affected

1 ranges
VendorProductVersion rangeFixed in
tychesoftwaresprint_invoice_delivery_notes_for_woocommerce<= 5.8.0—

Detection & IOCsextracted from sources · hover to see the quote

url/wp-content/plugins/woocommerce-delivery-notes/readme.txt↗
path/wp-content/plugins/woocommerce-delivery-notes/↗
filenametemplate.php↗
  • →Exploit entry point is the unauthenticated 'WooCommerce_Delivery_Notes::update' function — monitor for unauthenticated POST/AJAX requests targeting this WordPress action with no capability check ↗
  • →RCE is achieved via PHP execution enabled in Dompdf combined with unsanitised input in template.php — alert on Dompdf PHP execution or unexpected PHP evaluation triggered from the woocommerce-delivery-notes plugin context ↗
  • →Use FOFA/Shodan fingerprint query to identify exposed instances: search for body containing the plugin path string ↗
  • ·The vulnerability requires Dompdf to have PHP execution enabled (non-default in hardened deployments); sites where Dompdf PHP is disabled are not exploitable via this vector ↗
  • ·The Nuclei template is passive/version-check only (max-request: 2) and does not confirm active exploitation — a version match alone indicates exposure, not confirmed compromise ↗

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vulncheck9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.