WooCommerce Delivery Notes CVE-2026-56060

The target site must run WordPress with WooCommerce and the Print Invoice & Delivery Notes for WooCommerce plugin at version 7.1.1 or earlier. Per the CVSS vector (PR:N/UI:N/AC:L), no authentication, no user interaction, and low complexity are required, so a default installation is exposed to anonymous network requests. The practical limiting factor not resolved by the available data is whether retrieving a specific victim's document requires knowing or guessing an order ID/token - if order references must be enumerated, mass exploitation is somewhat constrained; if a listing or predictable path exists, it is fully automatable. The exposure is read-only (C:H, I:N, A:N), so it cannot be used to modify or disrupt the store.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) is internally consistent: network attack vector, low complexity, no privileges, no user interaction, high confidentiality impact and no integrity or availability impact - a clean unauthenticated read-only data-leak profile yielding 7.5 (High). EPSS is not provided in the input, so exploitation probability cannot be quantified. KEV status is absent (not actively exploited per available data) and no POC is referenced, so the real-world signal is lower than the raw 7.5 suggests - this looks like a credible but currently unweaponized confidentiality flaw rather than an under-attack emergency. Note the gap: the description does not specify the exact exposed endpoint or whether exposure requires knowing/guessing order IDs, which would affect how automatable mass exploitation is. SSVC fields were not supplied and cannot be evaluated.

An attacker enumerates a WooCommerce storefront, identifies the Print Invoice & Delivery Notes plugin, and requests the invoice/delivery-note endpoint directly without logging in - potentially iterating order identifiers - to harvest customer names, addresses, and order contents. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, this requires only HTTP access and no credentials or victim interaction. No public POC is referenced in the available data, so the attacker would need to derive the exposed path from analysis of the plugin.