What is the CVSS score of CVE-2026-56060?

CVE-2026-56060 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Which versions of WooCommerce Delivery Notes are affected by CVE-2026-56060?

The Print Invoice & Delivery Notes for WooCommerce plugin (versions 7.1.1 and earlier) allows unauthenticated remote users to access sensitive customer invoices and delivery notes; no public exploit…

How to fix or mitigate CVE-2026-56060?

24 hours: Conduct an inventory of all WordPress/WooCommerce installations running the Print Invoice & Delivery Notes plugin, identify deployed versions, and document which instances are internet-exposed; prioritize any affecting customer-facing systems. 7 days: Implement interim controls such as Web Application Firewall rules to restrict access to invoice and delivery note endpoints, enable detailed access logging, and audit recent logs for signs of unauthorized retrieval. 30 days: Monitor vendor channels for a security patch release; if no patch is available, evaluate replacement with an actively maintained alternative plugin or develop a custom secure solution.

WooCommerce Delivery Notes CVE-2026-56060

EUVD-2026-39714 HIGH

Exposure of Sensitive System Information to an Unauthorized Control Sphere (CWE-497)

2026-06-26 audit@patchstack.com

GHSA-68j4-4qgv-952m

WordPress Information Disclosure

7.5

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Unauthenticated network-reachable read of sensitive order documents with no interaction gives AV:N/AC:L/PR:N/UI:N and C:H; no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (patchstack).

CVSS VectorVendor: patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 26, 2026 - 15:59 vuln.today

CVE Published

Jun 26, 2026 - 15:16 cve.org

HIGH 7.5

DescriptionCVE.org

Unauthenticated Sensitive Data Exposure in Print Invoice & Delivery Notes for WooCommerce <= 7.1.1 versions.

Articles & Coverage 1

News 11 New WordPress Vulnerabilities - 1 Critical, 10 High, 2 With POC Jun 27, 2026

AnalysisAI

Unauthenticated information disclosure in the Print Invoice & Delivery Notes for WooCommerce plugin (versions 7.1.1 and earlier) lets remote attackers retrieve sensitive order data - such as invoices and delivery notes - without any credentials. The CVSS 3.1 score of 7.5 reflects a network-reachable, no-interaction confidentiality breach. No public exploit is identified at time of analysis and it is not listed in CISA KEV, so exploitation appears unproven but trivially feasible given the access profile.

Technical ContextAI

The affected component is a WordPress plugin that extends WooCommerce to generate printable invoices and packing/delivery notes for store orders. The root cause is classified as CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere), meaning the plugin exposes invoice/order content through a path that lacks proper access control - typically an endpoint, query parameter, or generated document URL that is reachable without authentication. Because these documents contain customer PII and order details, the exposure spans the plugin's order-document handling rather than the WordPress or WooCommerce core. The CPE/affected scope is the plugin slug woocommerce-delivery-notes at versions up to and including 7.1.1.

RemediationAI

Upgrade the Print Invoice & Delivery Notes for WooCommerce plugin to a release newer than 7.1.1; no exact fixed version number is stated in the available data, so consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/woocommerce-delivery-notes/vulnerability/wordpress-print-invoice-delivery-notes-for-woocommerce-plugin-7-1-1-sensitive-data-exposure-vulnerability) and the plugin's WordPress.org changelog for the patched version and update promptly. Until patched, restrict unauthenticated access to the plugin's invoice/delivery-note endpoints at the web-server or WAF layer (for example, block or require authentication on the document-generation URLs), which prevents anonymous retrieval but may break legitimate customer-facing 'print invoice' links if your store relies on them. As a stronger interim control, deactivate the plugin if invoice/delivery-note functionality is non-essential, accepting the loss of that feature. A virtual patch via Patchstack or another WordPress WAF is a reasonable compensating control where immediate upgrade is not possible.