Missing authorization in the Print Invoice & Delivery Notes for WooCommerce plugin allows an attacker to bypass intended access controls and retrieve data that should be protected. Because the plugin delivers invoices and delivery notes, any user who can trigger the relevant endpoints may access sensitive transactional information. This breach of access control is categorized as CWE‑862.

WordPress sites that deploy tychesoftwares Print Invoice & Delivery Notes for WooCommerce version 5.9.0 or earlier, and all earlier releases, are affected. Site administrators who have not updated the plugin remain vulnerable.

The CVSS score of 7.5 denotes a medium‑to‑high severity, and the EPSS value of less than 1 % suggests that wild exploitation is currently unlikely. This vulnerability is not listed in the CISA KEV catalog, indicating no known high‑profile attacks. The attack path appears to be a simple HTTP request to the plugin's invoice or delivery‑note endpoints, but the exact prerequisites—such as whether authentication is required—are not described in the CVE. Given the potential for significant data exposure and the low effort needed to patch, the risk remains elevated.