VulnSocial

CVE-2025-13773Active Exploitation

MEDIUMCVSS 9.8 · CRITICAL

Exploitation ongoing with high activity in latest observed window (1 mentions)

Immediate actions

  • Prioritize remediation for affected systems immediately
  • Assume compromise if assets are exposed
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft
  • Track advisory updates for patch or workaround availability

Recommended action window: Immediate (within 24h)

NVD description

The Print Invoice & Delivery Notes for WooCommerce plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 5.8.0 via the 'WooCommerce_Delivery_Notes::update' function. This is due to missing capability check in the 'WooCommerce_Delivery_Notes::update' function, PHP enabled in Dompdf, and missing escape in the 'template.php' file. This makes it possible for unauthenticated attackers to execute code on the server.

Back to dashboard
5.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-94

Priority

MEDIUM

Exploitation

ACTIVE

PoC

YES

Patch

NONE

Momentum

STABLE

Threat summary

  • Active exploitation appears in 1 classified signals
  • Public PoC is present in monitored signal
  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Active exploitation reported across 1 signal
  • PoC mentioned or linked in 2 signals
  • Technical details provided in 1 signal
  • Peaked 1d ago at 1 mentions (2026-04-14); latest day: 1
  • 2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-04-14: 1Mentions · 2026-06-07: 1PoC Mentioned / Linked · 2026-04-14: 1PoC Mentioned / Linked · 2026-06-07: 1Active Exploitation · 2026-04-14: 1Technical Details · 2026-06-07: 104-1406-07
Signal classification2 categories
Active Exploitation
150.0%
PoC
150.0%
Referenced assets2 URLs
Classification over time
DateTotalLabels
2026-04-141
Active Exploitation1
2026-06-071
PoC1
Full discourse2 posts
  • pdnuclei-bot@pdnuclei_bot
    PoC

    🚨 CVE-2025-13773 - critical 🚨 WordPress Print Invoice & Delivery Notes for WooCommerce <= 5.8.0 - Remote Code Execution > Print Invoice & Delivery Notes for WooCommerce plugin for WordPress <= 5.8.0 contains... 👾 https://cloud.projectdiscovery.io/library/CVE-2025-13773 @pd...

    Post summary

    CVE-2025-13773 is a remote code execution vulnerability in the WordPress Print Invoice & Delivery Notes plugin (<=5.8.0). A public Proof‑of‑Concept is linked, but no patch or active exploitation reports are mentioned.

    0000083
    952 followersView on X
  • CTIWatch@ctiwatchcloud
    Active Exploitation

    🚨 [HIGH] Active exploitation detected: CVE-2025-13773 Exploit in the wild confirmed for CVE-2025-13773 (CVSS null). The Print Invoice &amp; Delivery Notes for WooCommerce plugin for WordPress is vulnerable to... 🔗 http://ctiwatch.cloud/alerts #ZeroDay #ExploitInWild #CyberSecurity

    Post summary

    The tweet indicates that CVE‑2025‑13773 is actively exploited against the WooCommerce Print Invoice & Delivery Notes plugin, with a link to an alert, but lacks remediation details or technical depth.

    00000219
    5.6K followersView on X

Explore more

Back to dashboard