CVE-2025-49239: 
WordPress vulnerability analysis and mitigation

Cross-Site Request Forgery (CSRF) vulnerability was discovered in tychesoftwares Print Invoice & Delivery Notes for WooCommerce plugin affecting versions through 5.5.0. The vulnerability was disclosed on June 6, 2025, and assigned CVE-2025-49239. The issue was identified and reported by Nguyen Tran Tuan Dung (domiee13) on April 26, 2025 (Patchstack).

The vulnerability is classified as a Cross-Site Request Forgery (CSRF) with a CVSS v3.1 Base Score of 5.4 (Medium) and vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L. The vulnerability is tracked under CWE-352 (Cross-Site Request Forgery) (NVD).

The vulnerability could allow a malicious actor to force higher privileged users to execute unwanted actions under their current authentication. The CVSS score of 5.4 indicates a medium severity impact with potential for low-level integrity and availability compromises (Patchstack).

The vulnerability requires no authentication (unauthenticated) to exploit, though user interaction is required. The exploitation probability is considered low, and there are no known public exploits at the time of disclosure (Patchstack).

The vulnerability has been fixed in version 5.6.0 of the Print Invoice & Delivery Notes for WooCommerce plugin. Users are advised to update to version 5.6.0 or later to remove the vulnerability (Patchstack).