CVE-2025-13773
Last modified
CVE-2025-13773 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. The Print Invoice & Delivery Notes for WooCommerce plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 5.8.0 via the 'WooCommerce_Delivery_Notes::update' function. This is due to missing capability check in the 'WooCommerce_Delivery_Notes::update' function, PHP enabled in Dompdf, and missing escape in the 'template.php' file. EPSS estimates a 3.20% chance of exploitation in the next 30 days.
Description
The Print Invoice & Delivery Notes for WooCommerce plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 5.8.0 via the 'WooCommerce_Delivery_Notes::update' function. This is due to missing capability check in the 'WooCommerce_Delivery_Notes::update' function, PHP enabled in Dompdf, and missing escape in the 'template.php' file. This makes it possible for unauthenticated attackers to execute code on the server.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2025-13773?
How severe is CVE-2025-13773?
How do I fix CVE-2025-13773?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-13768WebITR developed by Uniong has an Authentication Bypass vuln…8.8
- CVE-2025-13769WebITR developed by Uniong has a SQL Injection vulnerability…7.1
- CVE-2025-1377A vulnerability, which was classified as problematic, has be…5.5
- CVE-2025-13770WebITR developed by Uniong has a SQL Injection vulnerability…7.1
- CVE-2025-13771WebITR developed by Uniong has an Arbitrary File Read vulner…7.1
- CVE-2025-13772GitLab has remediated an issue in GitLab EE affecting all ve…4.3
- CVE-2025-13774A vulnerability exists in Progress Flowmon ADS versions prio…8.8
- CVE-2025-13776Multiple Finka programs use hard-coded Firebird database cre…7.1
- CVE-2025-13777Authentication bypass by capture-replay vulnerability in ABB…8.3
- CVE-2025-13778Missing authentication for critical function vulnerability i…7.1
- CVE-2025-13779Missing authentication for critical function vulnerability i…8.3
- CVE-2025-1378A vulnerability, which was classified as problematic, was fo…4.8
Are you affected by CVE-2025-13773?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST