Cyber Posture

CVE-2025-13773

Critical

Published: 24 December 2025

Published
24 December 2025
Modified
15 April 2026
KEV Added
—
Patch
—
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0052 67.0th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Description

The Print Invoice & Delivery Notes for WooCommerce plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 5.8.0 via the 'WooCommerce_Delivery_Notes::update' function. This is due to missing capability check in the 'WooCommerce_Delivery_Notes::update' function,…

more

PHP enabled in Dompdf, and missing escape in the 'template.php' file. This makes it possible for unauthenticated attackers to execute code on the server.

Mitigating Controls (NIST 800-53 r5)AI

AC-3 Access Enforcement good match
prevent

Enforces approved authorizations to block unauthenticated access to the vulnerable WooCommerce_Delivery_Notes::update function.

SI-10 Information Input Validation good match
prevent

Validates and sanitizes inputs to prevent code injection through the unescaped data in template.php.

CM-6 Configuration Settings good match
prevent

Mandates secure configuration settings to disable PHP execution in Dompdf, eliminating the code execution vector.

Security SummaryAI

CVE-2025-13773 is a remote code execution vulnerability in the Print Invoice & Delivery Notes for WooCommerce plugin for WordPress, affecting all versions up to and including 5.8.0. The issue originates in the 'WooCommerce_Delivery_Notes::update' function due to a missing capability check, PHP execution enabled within Dompdf, and missing escaping in the 'template.php' file, classified under CWE-94 (Code Injection).

Unauthenticated attackers can exploit this vulnerability remotely with low attack complexity, no privileges, and no user interaction required, as indicated by its CVSS score of 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Successful exploitation enables arbitrary code execution on the server, granting high impacts to confidentiality, integrity, and availability.

References provided link to vulnerable code locations in the plugin's source repository, including lines 347 and 473 in class-woocommerce-delivery-notes.php (missing capability check), line 52 in dompdf/src/PhpEvaluator.php (PHP enabled), line 37 in wcdn-front-function.php, and line 36 in templates/pdf/simple/invoice/template.php (missing escape).

Details

CWE(s)
CWE-94

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

The vulnerability is an unauthenticated remote code execution in a public-facing WordPress plugin, directly enabling exploitation of a public-facing application.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References