External risk intelligence

WooCommerce Delivery Notes Plugin Remote Code Execution Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-13773

The vulnerability exists in a WordPress plugin used for WooCommerce store functionality. Such plugins are commonly deployed on public-facing web servers to facilitate e-commerce operations, making the vulnerable code paths reachable over the internet as part of the standard web application environment.

Code Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in a WordPress plugin used for generating invoices and delivery notes within WooCommerce stores. This flaw, present in all versions up to 5.8.0, allows unauthenticated attackers to potentially execute arbitrary code on the server due to insufficient checks and improper handling of templates. The main concern is confirming if your WooCommerce sites are affected by this plugin and assessing the exposure.

Plugin flaw allows server code execution.
Confirms relevance and exposure is key.
Understand potential impact on e-commerce operations.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending a specially crafted request to a WordPress site. This request would target a function within the Print Invoice & Delivery Notes for WooCommerce plugin that lacks proper authorization checks. By manipulating this function, an unauthenticated attacker could potentially execute arbitrary code on the server, leading to a compromise of the website.

No authentication required.
Triggered via a crafted request.
Risk of arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to execute arbitrary code on the server hosting the WordPress site. This is possible because the affected plugin has a missing capability check, uses PHP within its PDF generation library, and lacks proper sanitization in its template files, potentially enabling attackers to inject and run malicious scripts when supported by the advisory.

Server-side code execution.
Unauthenticated network access.
Compromise of website integrity.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Print Invoice & Delivery Notes for WooCommerce plugin vulnerability requires immediate attention from WordPress administrators and application owners. This critical flaw allows unauthenticated remote code execution, posing a significant risk to any e-commerce site using the affected plugin. The first step is to confirm if this plugin is deployed, assess its exposure, identify the accountable owner, and then prioritize remediation based on business criticality.

WordPress administrators and application owners should own this.
Verify plugin installation and exposure to external traffic.
Plan immediate upgrade or disable the plugin.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Print Invoice & Delivery Notes for WooCommerce plugin?

This plugin is an add-on for WordPress websites that use WooCommerce for e-commerce. It allows store owners to automatically generate, customize, and print invoices, packing slips, and delivery notes for customer orders, streamlining the fulfillment process.

What does CWE-94 mean for CVE-2025-13773?

CWE-94 refers to Improper Control of Generation of Code. In this case, the plugin fails to verify who is allowed to run certain functions and insecurely handles template data. This allows an attacker to inject their own instructions into the server, which the software then executes as if it were legitimate code.

How is this vulnerability triggered?

An attacker triggers this by sending a specially crafted web request to the server. Because the plugin does not verify if the person sending the request has the proper authority, it processes the request automatically. Simply browsing the site normally or performing standard administrative tasks does not trigger the vulnerability; it requires a malicious, targeted input.

Is my site at risk according to Halo Surface Signal?

Yes, if you use this plugin on a public-facing website. Halo Surface Signal identifies that because e-commerce stores are designed to be reachable over the internet, the vulnerable code paths in this plugin are directly exposed to the network, making it possible for attackers to reach them remotely without needing a login.

What should I do if I use this plugin?

First, verify if the plugin is installed on your WordPress site. If it is, determine if your version is 5.8.0 or older, as these are affected. If you cannot update to a patched version immediately, consider disabling or removing the plugin until you can confirm the security of your environment to prevent unauthorized access to your server.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.