Print Invoice & Delivery Notes for WooCommerce Vulnerability – Missing Authorization to Notice Dismissal – CVE-2024-4233 | WordPress Plugin Vulnerability Report 

Plugin Name: Print Invoice & Delivery Notes for WooCommerce

Key Information:

  • Software Type: Plugin
  • Software Slug: woocommerce-delivery-notes
  • Software Status: Active
  • Software Author: tychesoftwares
  • Software Downloads: 999,558
  • Active Installs: 40,000
  • Last Updated: May 10, 2024
  • Patched Versions: 4.9.0
  • Affected Versions: <= 4.8.1

Vulnerability Details:

  • Name: Multiple Plugins by tychesoftwares <= 4.8.1
  • Title: Missing Authorization to Notice Dismissal
  • Type: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
  • CVE: CVE-2024-4233
  • CVSS Score: 4.3
  • Publicly Published: April 26, 2024
  • Researcher: Dhabaleshwar Das
  • Description: The Print Invoice & Delivery Notes for WooCommerce plugin, among others by tychesoftwares, contains a vulnerability in versions up to and including 4.8.1. This flaw arises from a missing capability check in the ts_admin_notices() function, which allows authenticated users with subscriber-level access to inappropriately dismiss administrative notices. This could lead to unauthorized data modification.


The Print Invoice & Delivery Notes plugin for WooCommerce has a vulnerability in versions up to and including 4.8.1 that allows authenticated users to dismiss administrative notices without proper authorization. This security flaw has been resolved in version 4.9.0.

Detailed Overview:

This vulnerability is particularly concerning because it could potentially be exploited to alter the behavior of the plugin without the site administrator's knowledge, affecting how notices are managed and potentially leading to broader security implications. Although the impact is primarily limited to data integrity rather than theft, the ability for lower-level users to dismiss notices could interfere with administrative workflows and compliance with best practices.

Advice for Users:

  • Immediate Action: Update to the patched version 4.9.0 immediately to close this security gap.
  • Check for Signs of Vulnerability: Administrators should verify that all system notices are functioning as expected and review user roles and permissions to ensure no unauthorized changes have been made.
  • Alternate Plugins: Consider using alternative plugins for managing print invoices and delivery notes if continuing concerns about security persist post-update.
  • Stay Updated: Always ensure that your plugins are updated to the latest versions to mitigate the risk of vulnerabilities.


The swift response by tychesoftwares to patch this vulnerability in the Print Invoice & Delivery Notes for WooCommerce plugin highlights the ongoing need for vigilance in software maintenance. By promptly updating to version 4.9.0, users can ensure their WordPress installations remain secure and that administrative controls remain strictly in the hands of authorized users only.


Detailed Report: 

In an era where e-commerce security is paramount, the discovery of a vulnerability in a widely used plugin like "Print Invoice & Delivery Notes for WooCommerce" underscores the continuous need for vigilance and proactive security measures. The vulnerability, identified as CVE-2024-4233, highlights the critical importance of keeping website components updated to protect against potential cyber threats. This blog post delves into the vulnerability details, its potential impacts, and the necessary steps to mitigate risks to maintain a secure WordPress installation.

Vulnerability Details

CVE-2024-4233 involves a missing capability check within the ts_admin_notices() function of the plugin, which allowed authenticated users with just subscriber-level access to dismiss administrative notices improperly. This seemingly minor capability could lead to unauthorized data modifications and undermine administrative workflows.

Impact and Risks

While the direct impact of this vulnerability might seem limited to notice dismissal, the potential for broader security implications exists. Unauthorized dismissal of notices can prevent site administrators from receiving important security warnings or updates, potentially leaving the site vulnerable to further exploitation. This vulnerability underscores the need for strict role-based access controls and continuous monitoring of user activities within WordPress environments.

Remediation Steps

To address CVE-2024-4233, tychesoftwares released version 4.9.0 of the plugin, which patches the vulnerability and reinstates proper authorization checks.

  • Immediate Action: Users should update to version 4.9.0 immediately to mitigate the security risk.
  • Check for Signs of Vulnerability: Administrators are advised to audit their site logs and check user roles and permissions for any signs of unauthorized activity or inconsistencies.
  • Alternate Plugins: Those concerned about ongoing security risks may consider alternative plugins for managing print invoices and delivery notes, ensuring they are also well-supported and regularly updated.
  • Stay Updated: Consistently updating plugins and the WordPress core is crucial for maintaining security.

Overview of Previous Vulnerabilities

Prior to CVE-2024-4233, there have been two other documented vulnerabilities within this plugin since February 2, 2023. Each instance has reinforced the necessity of routine security audits and updates as part of an effective cybersecurity strategy.


The swift action by tychesoftwares to address and patch this vulnerability in the Print Invoice & Delivery Notes for WooCommerce plugin illustrates the ongoing challenges and the importance of timely updates in software management. For small business owners, particularly those with limited time to dedicate to website maintenance, leveraging automated update features, employing managed WordPress hosting solutions, and engaging with professional security services can provide both security assurances and operational efficiency. Staying informed about potential vulnerabilities and maintaining up-to-date systems are indispensable strategies in safeguarding a business’s online presence.

Staying Secure

Staying on top of WordPress security can feel overwhelming for small business owners without dedicated IT staff. At Your WP Guy, we exist to shoulder that burden for you. Our WordPress experts can fully audit, secure, maintain and support your site - so you can focus on growing your business with peace of mind.

Don't tackle security risks alone. Let us help you assess any impact from this vulnerability, update your plugins, and implement ongoing maintenance to avoid future threats. We treat your website like it's our own - because we know how critical it is for reaching your customers.

Get in touch for a free consultation today on making WordPress security stress-free. Call 678-995-5169 or book a call here. Our knowledgeable team is ready to help you safeguard your online presence.

Print Invoice & Delivery Notes for WooCommerce Vulnerability – Missing Authorization to Notice Dismissal – CVE-2024-4233 | WordPress Plugin Vulnerability Report FAQs

Leave a Comment