CVE-2025-49239: WooCommerce Delivery Notes CSRF Vulnerability

CVE-2025-49239 Overview

CVE-2025-49239 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the Tyche Softwares Print Invoice & Delivery Notes for WooCommerce plugin (woocommerce-delivery-notes). The flaw affects all versions up to and including 5.5.0. An attacker can trick an authenticated WordPress user into submitting a forged request that performs unintended plugin actions on their behalf. The issue is tracked under CWE-352 and requires user interaction to succeed. Exploitation delivers limited integrity and availability impact without direct data disclosure. The vulnerability is documented in the Patchstack advisory.

Critical Impact
Attackers can coerce authenticated WooCommerce administrators to execute plugin state changes by visiting a malicious page, altering invoice or delivery note configurations without consent.

Affected Products

Tyche Softwares Print Invoice & Delivery Notes for WooCommerce plugin versions n/a through 5.5.0
WordPress installations running the vulnerable woocommerce-delivery-notes plugin
WooCommerce-based e-commerce sites relying on the plugin for order documentation

Discovery Timeline

2025-06-06 - CVE-2025-49239 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-49239

Vulnerability Analysis

The vulnerability stems from missing or insufficient CSRF protection in the Print Invoice & Delivery Notes for WooCommerce plugin. WordPress plugins typically enforce request authenticity through nonce tokens generated by wp_create_nonce() and validated via check_admin_referer() or wp_verify_nonce(). When these controls are absent or improperly implemented, an attacker-controlled page can forge authenticated requests to plugin endpoints. The vulnerable plugin exposes actions that execute state-changing operations without adequate origin validation. An attacker crafts a malicious webpage containing an auto-submitting form or image tag pointing at the target endpoint. When a logged-in shop administrator visits that page, the browser attaches valid session cookies, and the request executes with the victim's privileges.

Root Cause

The root cause is missing anti-CSRF token validation on plugin action handlers, categorized under CWE-352. The plugin trusts the authenticated session state without confirming request intent. Any HTTP request originating from an authenticated browser is processed regardless of the referring origin.

Attack Vector

The attack vector is network-based and requires user interaction. The attacker must lure an authenticated WordPress administrator to visit or interact with an attacker-controlled page. Refer to the Patchstack advisory for technical specifics on the affected endpoints.

No verified public exploit code is available for this vulnerability. The vulnerability mechanism relies on standard CSRF techniques where a hidden HTML form on a malicious page targets the plugin's admin action URL, causing the victim's authenticated browser to submit the forged request.

Detection Methods for CVE-2025-49239

Indicators of Compromise

Unexpected changes to invoice templates, delivery note configurations, or plugin settings not initiated by administrators
HTTP POST requests to plugin endpoints with Referer headers pointing to external or unrelated domains
Administrator sessions generating plugin action requests immediately after visiting external links

Detection Strategies

Inspect WordPress access logs for plugin action requests lacking valid nonce parameters
Correlate administrator browsing telemetry with subsequent plugin configuration changes to identify forged submissions
Deploy web application firewall rules that require a same-origin Referer or Origin header on plugin admin endpoints

Monitoring Recommendations

Enable WordPress audit logging plugins to record settings changes with user, timestamp, and source IP
Monitor outbound clicks from administrator email accounts and correlate with plugin action requests
Alert on plugin configuration modifications occurring outside standard administrative workflows

How to Mitigate CVE-2025-49239

Immediate Actions Required

Update the Print Invoice & Delivery Notes for WooCommerce plugin to a version later than 5.5.0 once released by Tyche Softwares
Restrict WordPress administrator accounts to dedicated browsers or sessions not used for general web browsing
Audit recent plugin configuration changes for unauthorized modifications and roll back where necessary

Patch Information

At the time of the NVD entry, the advisory indicates the vulnerability affects versions from n/a through 5.5.0. Site administrators should consult the Patchstack advisory and the vendor's plugin page for the current fixed release and upgrade to the latest available version.

Workarounds

Deactivate the woocommerce-delivery-notes plugin until a patched version is installed if the affected functionality is not required
Enforce web application firewall rules that block cross-origin POST requests to /wp-admin/ endpoints associated with the plugin
Require administrators to re-authenticate before performing sensitive plugin operations by shortening WordPress session cookie lifetimes

bash

# Example WAF rule concept: block cross-origin POSTs to plugin admin endpoints
# ModSecurity-style pseudo-rule
SecRule REQUEST_METHOD "@streq POST" \
  "chain,deny,status:403,msg:'Cross-origin POST to WooCommerce Delivery Notes blocked'"
  SecRule REQUEST_URI "@contains wp-admin" \
    "chain"
    SecRule REQUEST_HEADERS:Referer "!@beginsWith https://your-site.example.com/"