The vulnerability is a Cross‑Site Request Forgery in the Print Invoice & Delivery Notes for WooCommerce plugin that allows an attacker to induce a logged‑in user to invoke privileged actions, such as generating invoices or delivery notes, without the user’s consent. The weakness is classified as CWE‑352. The impact is the potential for confidential or integrity compromise if sensitive financial documents are created or modified by an attacker, though no direct exploitation of the data itself is described in the advisory.

WordPress sites using the tychesoftwares Print Invoice & Delivery Notes for WooCommerce plugin, versions up to and including 5.5.0, are affected. No specific sub‑versions are listed, so any release prior to or equal to 5.5.0 should be considered vulnerable.

The CVSS score of 5.4 indicates moderate severity, and the EPSS score of less than 1% suggests low current exploitation likelihood. The vulnerability is not listed in the CISA KEV catalog. Attackers would likely need to trick a logged‑in user into visiting a malicious site that submits a forged request; the required authentication state and lack of explicit authentication hardening in the plugin increase the attacker's chances compared to fully protected endpoints.