CVE-2025-67589

MediumCVSS 4.3

Published: 09/12/2025(UTC)Updated: 08/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.23%

12th percentile - higher than 12% of all known CVEs

Summary

Missing Authorization vulnerability in WP Overnight WooCommerce PDF Invoices & Packing Slips (woocommerce-pdf-invoices-packing-slips) allows exploiting incorrectly configured access control security levels. This issue affects versions through 4.9.1.

Risk Assessment

An attacker can exploit the missing authorization to perform unauthorized actions, such as accessing administrative functions or modifying settings, potentially compromising the integrity of the WooCommerce store.

Recommendation

Update the plugin to the latest patched version. Additionally, review permission configurations and ensure access control is properly set.

Other vulnerabilities in WooCommerce PDF Invoices & Packing Slips

CVE-2026-39472High
The WooCommerce PDF Invoices & Packing Slips plugin versions below 5.9.0 contain a PHP Object Injection vulnerability in the shop manager.

Original NVD description (English source)

Missing Authorization vulnerability in WP Overnight WooCommerce PDF Invoices & Packing Slips woocommerce-pdf-invoices-packing-slips allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce PDF Invoices & Packing Slips: from n/a through <= 4.9.1.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS