The Print Invoice & Delivery Notes for WooCommerce plugin contains an unauthenticated code injection vulnerability due to a missing capability check in its update routine, PHP execution enabled inside the Dompdf library, and lack of escaping in its template. This flaw is a CWE-94 injection that allows an attacker to inject and execute arbitrary PHP code when a PDF is requested. Based on the description, the likely attack vector is an unauthenticated HTTP request to the update endpoint that triggers PDF generation.

Tyche Softwares publishes the Print Invoice & Delivery Notes for WooCommerce plugin for WordPress. All releases up to and including 5.8.0 are affected; the vulnerability is present in the ‘update’ function of the plugin. The vendor has released newer versions that address the issue, but the CVE entry does not list a specific patched version.

The CVSS score of 9.8 marks this as a critical severity flaw, but the EPSS score of less than 1% indicates a very low probability of active exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. Because the flaw is unauthenticated, no special privileges are required; an attacker can trigger the code execution simply by sending the crafted request to the vulnerable endpoint. Thus, the risk is high if the plugin is present, but the practical exploit likelihood remains low without visible attacks.