Print Invoice Delivery Notes For Woocommerce EUVD-2026-15641

Remote unauthenticated attacker against WooCommerce sites running Print Invoice & Delivery Notes for WooCommerce plugin version 5.9.0 or earlier with default access control configuration. No victim interaction required.

This vulnerability presents a significant real-world risk despite the absence of a CVSS score in the provided data. The attack vector is likely network-based with low attack complexity, as WordPress plugins are typically accessed via HTTP requests without requiring special privileges or user interaction. The absence of EPSS score and KEV status prevents definitive determination of active exploitation, but the simplicity of authorization bypass attacks and the widespread use of WooCommerce make this vulnerability highly exploitable. The CWE-862 classification indicates a fundamental access control flaw rather than a complex logic error, meaning public proof-of-concept exploits are feasible. From an SSVC perspective, this would likely qualify as having high technical impact (full data access), automatable exploitation (HTTP requests with parameter manipulation), and likely demonstrated or proof-of-concept availability given the plugin's popularity and the straightforward nature of authorization testing. The lack of CVSS/EPSS data is not reassuring; instead, it suggests this is a genuine priority requiring immediate patching rather than theoretical risk.

An attacker without administrative privileges but with any registered WordPress user account (such as a subscriber or customer account) crafts an HTTP request directly to the plugin's invoice generation or retrieval endpoint, bypassing the insufficient authorization checks. By manipulating request parameters or accessing the functionality directly via URL or API call, the attacker retrieves sensitive invoice data containing customer names, addresses, order totals, and payment information for orders they did not place. If the authorization flaw extends to modification operations, the attacker could alter invoice data, prices, or delivery information before customers receive them, enabling fraud or supply chain manipulation.