The Print Invoice & Delivery Notes for WooCommerce plugin for WordPress suffers from an exposure of sensitive information vulnerability (CWE-200) in all versions up to 5.4.1. The vulnerability arises because invoice files stored in the /wp-content/uploads/wcdn/invoice directory can be accessed without authentication when the email attachment feature is enabled. This allows attackers to retrieve sensitive invoice data directly from the file system via the 'wcdn/invoice' directory. The CVSS 3.1 base score is 5.9, reflecting a medium severity with network attack vector, high attack complexity, no privileges required, no user interaction, and impact limited to confidentiality.

An unauthenticated attacker can access sensitive invoice files stored insecurely on the server, potentially exposing confidential customer or business information. The vulnerability does not affect integrity or availability but compromises confidentiality. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to disable the email attachment setting if possible and restrict direct access to the /wp-content/uploads/wcdn/invoice directory via web server configuration to prevent unauthorized file access.