CVE-2025-13773: 
WordPress vulnerability analysis and mitigation

CVE-2025-13773 is a critical Remote Code Execution (RCE) vulnerability in the "Print Invoice & Delivery Notes for WooCommerce" WordPress plugin, affecting all versions up to and including 5.8.0. The flaw allows unauthenticated attackers to execute arbitrary PHP code on the server by exploiting a combination of three weaknesses: a missing capability check in the WooCommerce_Delivery_Notes::update function, PHP execution enabled within the bundled Dompdf library, and missing output escaping in template.php. It was disclosed on December 24, 2025, with the CVE assigned by Wordfence. The CVSS v3.1 base score is 9.8 (Critical) (Wordfence, ENISA EUVD).

The vulnerability is classified as CWE-94 (Improper Control of Generation of Code / Code Injection) and results from three compounding weaknesses (Wordfence). First, the WooCommerce_Delivery_Notes::update function (at class-woocommerce-delivery-notes.php line 347 and 473) lacks a capability check, allowing any unauthenticated HTTP request to invoke it. Second, the plugin bundles Dompdf with PHP evaluation enabled (PhpEvaluator.php line 52), meaning PHP code embedded in PDF templates is executed server-side. Third, user-controlled input is not properly escaped in templates/pdf/simple/invoice/template.php (line 36), enabling injection of arbitrary PHP into the template rendered by Dompdf. An attacker can craft a network request with no authentication or user interaction required, making exploitation trivially achievable (Plugin Source, Gingerlime Advisory).

Successful exploitation grants an unauthenticated remote attacker full code execution on the web server running the vulnerable WordPress installation, resulting in complete compromise of confidentiality, integrity, and availability. Attackers can steal sensitive data (customer PII, payment information, credentials), modify or deface website content, install persistent backdoors or web shells, and use the compromised server as a pivot point for further attacks against internal infrastructure. The impact extends to all data processed by the WordPress/WooCommerce instance, including order and invoice data (Wordfence, ENISA EUVD).

A public proof-of-concept and detailed security advisory have been published by Gingerlime, demonstrating real-world exploitability (Gingerlime Advisory). Exploitation has been reported in the wild according to multiple threat intelligence sources. A Nuclei detection template has been submitted to the ProjectDiscovery repository, further lowering the barrier for automated scanning and exploitation (Nuclei PR). The EPSS score is approximately 0.53%, and the vulnerability is detectable by Qualys (detection ID 733556). As of the report date, CVE-2025-13773 does not appear in the CISA KEV catalog.

1. Reconnaissance: Identify WordPress sites running the "Print Invoice & Delivery Notes for WooCommerce" plugin version ≤5.8.0 using tools like WPScan, Shodan, or Censys, or by checking /wp-content/plugins/woocommerce-delivery-notes/ for version metadata.
2. Identify the vulnerable endpoint: Locate the unauthenticated AJAX or admin-post action that triggers WooCommerce_Delivery_Notes::update — this function lacks any capability/nonce check, making it accessible without authentication.
3. Craft a malicious payload: Prepare a request that injects PHP code into a template parameter processed by template.php. Because input is not escaped before being passed to Dompdf's PHP evaluator, arbitrary PHP (e.g., <?php system($_GET['cmd']); ?>) can be embedded.
4. Trigger PDF generation: Send the crafted HTTP POST request to the vulnerable endpoint. Dompdf processes the template with PHP evaluation enabled (PhpEvaluator.php), executing the injected PHP code server-side.
5. Achieve code execution: The injected PHP executes in the context of the web server process, enabling reverse shell establishment, file system access, credential harvesting, or web shell deployment for persistent access (Gingerlime Advisory, Plugin Source).

• Network: Unexpected POST requests to WordPress AJAX endpoints (/wp-admin/admin-ajax.php or admin-post.php) from unauthenticated sources targeting WooCommerce delivery note update actions; outbound connections from the web server to unknown external IPs (potential reverse shell activity).
• Logs: Web server access logs showing unauthenticated requests to the plugin's update action with unusual or encoded parameters; PHP error logs referencing PhpEvaluator.php or template.php with unexpected code execution traces.
• File System: New or modified PHP files in wp-content/plugins/woocommerce-delivery-notes/templates/ or wp-content/uploads/; presence of web shells (e.g., files named shell.php, cmd.php, or obfuscated PHP scripts) in writable directories.
• Process: Unusual child processes spawned by the web server process (e.g., bash, sh, curl, wget, python) not associated with normal WordPress operation.
• WordPress: Unexpected new administrator accounts; changes to plugin template files; unfamiliar scheduled tasks or cron jobs added to WordPress or the OS (Gingerlime Advisory).

The vendor released a patch in version 5.8.1 (changeset 3426119); all users should immediately update the plugin beyond version 5.8.0 (Plugin Changeset). As an interim measure, disable or deactivate the plugin until patching is complete. Deploy Web Application Firewall (WAF) rules to block unauthenticated requests targeting the WooCommerce_Delivery_Notes::update action. Additionally, review server logs and WordPress user accounts for signs of prior exploitation, and consider disabling PHP evaluation in Dompdf at the server configuration level if feasible (Wordfence, ENISA EUVD).

Wordfence, the CVE assigning authority, published a threat intelligence entry and included the vulnerability in their weekly WordPress vulnerability report covering December 15, 2025 to January 4, 2026 (Wordfence Blog). Gingerlime published a detailed security advisory with exploitation details, raising community awareness (Gingerlime Advisory). The vulnerability received coverage from The Hacker Wire and discussion on Bluesky and Mastodon (infosec.exchange), reflecting moderate community concern given the critical CVSS score and unauthenticated attack vector. A Nuclei template was submitted to ProjectDiscovery's community repository, indicating active interest from the security research community in automated detection.