The Print Invoice & Delivery Notes for WooCommerce plugin (versions up to 5.8.0) contains a remote code execution vulnerability (CWE-94) due to improper control of code generation. Specifically, the 'WooCommerce_Delivery_Notes::update' function lacks a capability check, PHP is enabled in Dompdf, and the 'template.php' file lacks proper escaping. These issues collectively allow unauthenticated attackers to execute arbitrary code on the server hosting the plugin. The vulnerability is publicly disclosed with a CVSS 3.1 score of 9.8, reflecting its critical severity and ease of exploitation without privileges or user interaction.

Successful exploitation allows unauthenticated attackers to execute arbitrary code on the affected server, potentially leading to full system compromise, data theft, service disruption, and further attacks. The vulnerability impacts confidentiality, integrity, and availability of the affected system. No known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the vulnerable plugin to prevent exploitation. Monitor official vendor channels for updates and apply patches promptly once available.