CVE-2026-25317: 
WordPress vulnerability analysis and mitigation

CVE-2026-25317 is a Missing Authorization (Broken Access Control) vulnerability in the "Print Invoice & Delivery Notes for WooCommerce" WordPress plugin developed by Tyche Softwares. It allows unauthenticated remote attackers to access invoices and delivery notes by exploiting incorrectly configured access control security levels. The vulnerability affects all plugin versions up to and including 5.9.0, with version 6.0.0 serving as the patched release. It was reported on December 27, 2025, and published on March 18–25, 2026. The CVSS v3.1 base score is 7.5 (High) (Patchstack).

The root cause is classified as CWE-862 (Missing Authorization), where certain plugin functions lack proper capability or nonce token checks before executing privileged actions. This allows unauthenticated network-based attackers to directly access endpoints that should be restricted to authorized users (e.g., shop managers or administrators), such as those serving invoice and delivery note documents. No user interaction or special privileges are required, and attack complexity is low. The vulnerability was discovered by security researcher "johska" and reported through Patchstack's coordinated disclosure process (Patchstack).

Successful exploitation allows unauthenticated attackers to retrieve sensitive WooCommerce order data, including customer personally identifiable information (PII), billing addresses, purchased items, and delivery details contained in invoices and delivery notes. The confidentiality impact is rated High, while integrity and availability are unaffected. This data exposure could facilitate follow-on attacks such as phishing, fraud, or targeted social engineering against affected customers (Patchstack).

No public proof-of-concept exploit code has been identified at this time. The EPSS score is approximately 0.017% (0.000170), indicating a low probability of exploitation in the near term. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, Patchstack notes that broken access control vulnerabilities of this type are commonly used in mass-exploit campaigns targeting large numbers of WordPress sites regardless of their traffic or popularity (Patchstack).

1. Reconnaissance: Identify WordPress sites running the "Print Invoice & Delivery Notes for WooCommerce" plugin (slug: woocommerce-delivery-notes) at version 5.9.0 or earlier using tools like WPScan, Shodan, or by checking publicly accessible readme.txt files at /wp-content/plugins/woocommerce-delivery-notes/readme.txt.
2. Identify unprotected endpoints: Enumerate plugin-registered WordPress REST API routes or admin-ajax actions associated with invoice/delivery note generation that lack authorization checks.
3. Craft unauthenticated request: Send a direct HTTP GET or POST request to the vulnerable endpoint (e.g., a WooCommerce order invoice URL) without any authentication cookies or nonce tokens.
4. Retrieve sensitive data: The server responds with invoice or delivery note content containing customer PII, order details, and billing/shipping addresses, which the attacker can harvest for fraud or further targeting (Patchstack).

• Network: Unusual unauthenticated HTTP requests to WooCommerce invoice or delivery note endpoints (e.g., URLs containing woocommerce-delivery-notes, invoice, or delivery-note parameters) from unknown or automated IP addresses.
• Logs: WordPress access logs showing repeated requests to plugin-specific endpoints without valid session cookies or nonce tokens, particularly in high volume suggesting automated scanning.
• Logs: Requests originating from known vulnerability scanner user-agents (e.g., WPScan, Nuclei) targeting the woocommerce-delivery-notes plugin path.

The vendor has released version 6.0.0 of the "Print Invoice & Delivery Notes for WooCommerce" plugin, which resolves this vulnerability. Site administrators should update the plugin to version 6.0.0 or later immediately via the WordPress admin dashboard. If an immediate update is not possible, consider temporarily deactivating the plugin or restricting access to the WordPress site using a web application firewall (WAF) rule. Patchstack users can enable auto-update for vulnerable plugins as an additional safeguard (Patchstack).