What is the CVSS score of CVE-2026-25317?

CVE-2026-25317 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by CVE-2026-25317?

CVE-2026-25317 presents notable security risk, a missing authorization vulnerability rated CVSS 7.5.

How to fix or mitigate CVE-2026-25317?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Monitor vendor channels for patch availability.

WordPress CVE-2026-25317

EUVD-2026-15641 HIGH

Missing Authorization (CWE-862)

2026-03-25 Patchstack

WordPress Authentication Bypass

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 16:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 25, 2026 - 16:47 euvd

EUVD-2026-15641

Analysis Generated

Mar 25, 2026 - 16:47 vuln.today

CVE Published

Mar 25, 2026 - 16:14 nvd

HIGH 7.5

DescriptionCVE.org

Missing Authorization vulnerability in tychesoftwares Print Invoice & Delivery Notes for WooCommerce woocommerce-delivery-notes allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Print Invoice & Delivery Notes for WooCommerce: from n/a through <= 5.9.0.

AnalysisAI

A missing authorization vulnerability exists in the Print Invoice & Delivery Notes for WooCommerce plugin (tychesoftwares) through version 5.9.0, allowing attackers to exploit incorrectly configured access control to bypass authentication mechanisms and gain unauthorized access to sensitive functionality. The vulnerability is classified as a broken access control issue (CWE-862) affecting all versions up to and including 5.9.0. Attackers can leverage this flaw to access restricted operations without proper authorization, potentially exfiltrating invoice and delivery note data or manipulating order information.

Technical ContextAI

The Print Invoice & Delivery Notes for WooCommerce plugin (cpe:2.3:a:tychesoftwares:print_invoice_&_delivery_notes_for_woocommerce:*:*:*:*:*:*:*:*) is a WordPress plugin designed to generate and manage printable invoices and delivery notes for WooCommerce-based e-commerce platforms. The vulnerability stems from CWE-862 (Missing Authorization), which indicates the plugin fails to properly implement authorization checks before allowing users to access sensitive operations or data. Rather than a missing authentication layer, this represents a broken access control flaw where the plugin does not verify user permissions or roles before granting access to invoice generation, viewing, or modification functions. WordPress plugins relying on improper capability checks or missing nonce validation commonly fall victim to this class of vulnerability.

RemediationAI

Upgrade Print Invoice & Delivery Notes for WooCommerce to a version newer than 5.9.0 immediately, as the vendor has patched this authorization bypass in subsequent releases. Website administrators should navigate to WordPress dashboard, go to Plugins > Installed Plugins, and update the woocommerce-delivery-notes plugin to the latest available version, then verify the update by checking the plugin version displayed in the Plugins list. Until a patched version is deployed, implement temporary mitigations by restricting access to the plugin's administrative functions through WordPress user role management, ensuring only trusted administrators have capability to generate or view invoices, and disabling direct access to invoice generation endpoints via web server configuration if the plugin can be isolated. Monitor the Patchstack vulnerability database (https://patchstack.com/database) and the vendor's official security channels for patched version availability and apply updates as soon as thoroughly tested in a staging environment.