Critical · published December 24, 2025
🚨 A single missing capability check is all it takes for attackers to execute code on servers running the Print Invoice & Delivery Notes for WooCommerce plugin! 🔥 Think of it like a front desk at a hotel that allows anyone to walk in and request a room key without verifying their identity. Any unauthorized guest could waltz right in and take control! This vulnerability could lead to absolutely devastating consequences, allowing attackers to run malicious code on your server, potentially compromising sensitive data, taking complete control, or even shutting down your operations! Imagine the chaos if a stranger could change the locks and access everything behind closed doors.
Think of it like a front desk at a hotel that allows anyone to walk in and request a room key without verifying their identity. Any unauthorized guest could waltz right in and take control! The vulnerability resides in the 'WooCommerce_Delivery_Notes::update' function, which lacks necessary capability checks paired with PHP enabled in Dompdf and missing escape in 'template.php'. This combination opens the door for unauthenticated attackers to perform remote code execution on the server.
This vulnerability could lead to absolutely devastating consequences, allowing attackers to run malicious code on your server, potentially compromising sensitive data, taking complete control, or even shutting down your operations! Imagine the chaos if a stranger could change the locks and access everything behind closed doors. Immediately update to version 5.8.1 or later of the Print Invoice & Delivery Notes plugin. Ensure capability checks are implemented in the 'update' function and review your security configurations to prevent unauthorized access. 🛡️ You've got this! With these steps, you'll fortify your security and keep your WordPress site safe! 🦸