Remote Code Execution Vulnerability in WooCommerce Delivery Notes Plugin by WordPress
CVE-2025-13773

9.8CRITICAL

Key Information:

Vendor

WordPress
Status
Print Invoice & Delivery Notes For WooCommerce
Vendor
CVE Published:
24 December 2025

What is CVE-2025-13773?

The Print Invoice & Delivery Notes for WooCommerce plugin is susceptible to a remote code execution flaw due to inadequate capability checks in the 'WooCommerce_Delivery_Notes::update' function. The vulnerability arises when PHP is enabled in Dompdf and certain escape functions are absent in the 'template.php' file. This combination allows unauthenticated attackers to run arbitrary code on the server, potentially compromising the integrity of the WordPress installation.

Affected Version(s)

Print Invoice & Delivery Notes for WooCommerce * <= 5.8.0

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/changeset/3426119/wooc...
https://plugins.trac.wordpress.org/browser/woocommerce-de...

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Angus Girvan
Marcin Dudek
JSON
.
CVE-2025-13773 : Remote Code Execution Vulnerability in WooCommerce Delivery Notes Plugin by WordPress