The vulnerability is a missing authorisation check that allows an attacker to bypass access controls for the Print Invoice & Delivery Notes for WooCommerce plugin. The flaw enables unauthenticated or insufficiently privileged users to view or download invoices and delivery notes that should be restricted to the site owner or legitimate buyers. This results in the disclosure of potentially sensitive financial information.

Tychesoftwares Print Invoice & Delivery Notes for WooCommerce, version 5.8.0 and earlier.

The flaw carries a CVSS score of 6.5, indicating moderate severity, and an EPSS score below 1%, showing a low probability of exploitation in the wild. It is not listed in the CISA KEV catalog. Attackers can exploit the issue by accessing the plugin’s public endpoints or API calls that expose invoice PDFs without verifying the requester’s identity. The plugin’s default configuration presents the attack surface, so any WordPress site running the affected plugin version is potentially vulnerable.