The Print Invoice & Delivery Notes for WooCommerce plugin suffers from a missing capability check on the 'wcdn_remove_shoplogo' AJAX action. This flaw enables any authenticated user with at least Subscriber privileges to remove the shop's logo without proper authorization. The vulnerability is classified under CWE-862 (Missing Authorization) and affects all versions up to 5.4.0. The CVSS 3.1 base score is 4.3, reflecting a medium severity with network attack vector, low attack complexity, and requiring privileges but no user interaction. No patch or vendor advisory has been provided to confirm remediation status.

The vulnerability allows unauthorized modification of the shop's logo by authenticated users with Subscriber-level access or higher. This impacts the integrity of the website's appearance but does not affect confidentiality or availability. There are no known exploits in the wild. The impact is limited to unauthorized changes to visual elements controlled by the plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict user roles to trusted individuals only and monitor for unauthorized changes to the shop logo. Avoid granting Subscriber or higher privileges to untrusted users. Follow updates from the vendor for an official fix.