WordPress Print Invoice & Delivery Notes for WooCommerce <= 5.8.0 - Remote Code Execution

criticalseverity

9.8CVSS score

3.7%likelihood of exploitation, next 30 days

90%of all CVEs are less likely

Readycheck to confirm it

Print Invoice & Delivery Notes for WooCommerce plugin for WordPress <= 5.8.0 contains a remote code execution caused by missing capability check, PHP enabled in Dompdf, and missing escape in template.php, letting unauthenticated attackers execute code on the server.

Impact

Unauthenticated attackers can execute arbitrary code on the server, potentially leading to full system compromise.

Fix

Update to the latest version beyond 5.8.0.

How to confirm it

Send: GET {{BaseURL}}/wp-content/plugins/woocommerce-delivery-notes/readme.txt
Positive when: status_code == 200 and compare_versions(version, '<= 5.8.0') and contains(body, 'Print Invoice & Delivery Notes')

Run it with nuclei: nuclei -id CVE-2025-13773 -u <target>

The full check

id: CVE-2025-13773

info:
  name: WordPress Print Invoice & Delivery Notes for WooCommerce <= 5.8.0 - Remote Code Execution
  author: PikaJuna-ops
  severity: critical
  description: |
    Print Invoice & Delivery Notes for WooCommerce plugin for WordPress <= 5.8.0 contains a remote code execution caused by missing capability check, PHP enabled in Dompdf, and missing escape in template.php, letting unauthenticated attackers execute code on the server.
  impact: |
    Unauthenticated attackers can execute arbitrary code on the server, potentially leading to full system compromise.
  remediation: |
    Update to the latest version beyond 5.8.0.
  reference:
    - https://www.wordfence.com/threat-intel/vulnerabilities/id/e52b34fe-2414-4d6f-bf43-9c5b65ebf769
    - https://plugins.trac.wordpress.org/changeset/3426119/woocommerce-delivery-notes
    - https://nvd.nist.gov/vuln/detail/CVE-2025-13773
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2025-13773
    epss-score: 0.03711
    epss-percentile: 0.89851
    cwe-id: CWE-94
  metadata:
    verified: true
    max-request: 2
    fofa-query: body="wp-content/plugins/woocommerce-delivery-notes/"
    product: woocommerce-delivery-notes
    vendor: tychesoftwares
  tags: cve,cve2025,wordpress,wp-plugin,woocommerce-delivery-notes,rce,passive,vkev

http:
  - method: GET
    path:
      - '{{BaseURL}}/wp-content/plugins/woocommerce-delivery-notes/readme.txt'

    matchers:
      - type: dsl
        dsl:
          - "status_code == 200"
          - "compare_versions(version, '<= 5.8.0')"
          - "contains(body, 'Print Invoice & Delivery Notes')"
        condition: and

    extractors:
      - type: regex
        part: body
        group: 1
        name: version
        regex:
          - 'Stable tag: ([0-9.]+)'
        internal: true

References

Use this check only on systems you are authorised to test. Where the data comes from