# CVE-2026-56060: Tyche Softwares Print Invoice & Delivery Notes for WooCommerce data exposure

Source: https://junglewise.ai/threats/cve-2026-56060-tyche-softwares-print-invoice-delivery-notes-for-woocommerce-data  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-26. Updated: 2026-06-26  
License: CC BY 4.0 with a link back

CVE-2026-56060 · Severity: high · CVSS 7.5 · Published 2026-06-26

A vulnerability in the Print Invoice & Delivery Notes plugin for WooCommerce allows unauthorized individuals to access sensitive information. This plugin is used by online stores to generate and manage customer billing and shipping documents. An exploit could lead to the exposure of private customer data or order details, potentially resulting in privacy violations and reputational damage.

Vendors: [Tyche Softwares](https://junglewise.ai/threats/vendors/tyche-softwares).

## Quick answers

**Is CVE-2026-56060 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-56060 being exploited in the wild.

**How severe is CVE-2026-56060?** High severity, with a CVSS score of 7.5, published 26 June 2026.

**Which products and versions are affected?** Tyche Softwares Print Invoice & Delivery Notes for WooCommerce <= 7.1.1.

**Is there a fix for CVE-2026-56060?** A patch was published on 7.1.2: Vulnerability fixed in version 7.1.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-56060 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-56060?** Check whether you run Tyche Softwares Print Invoice & Delivery Notes for WooCommerce at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Print Invoice & Delivery Notes for WooCommerce plugin (versions <= 7.1.1) is vulnerable to unauthenticated sensitive data exposure. The flaw is classified under CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere), indicating that sensitive data is accessible without requiring any user authentication or specific privileges. An attacker can exploit this over the network to view information that should be restricted to authorized users or administrators. The issue is resolved in version 7.1.2.

## Affected products

- Tyche Softwares Print Invoice & Delivery Notes for WooCommerce <= 7.1.1

## Timeline

- 2026-04-27: other: Reported by Jakub Herman
- 2026-06-25: advisory: Patchstack advisory published
- 2026-06-26: disclosed: NVD publication date
- 7.1.2: patched: Vulnerability fixed in version 7.1.2

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/wordpress/plugin/woocommerce-delivery-notes/vulnerability/wordpress-print-invoice-delivery-notes-for-woocommerce-plugin-7-1-1-sensitive-data-exposure-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/woocommerce-delivery-notes/vulnerability/wordpress-print-invoice-delivery-notes-for-woocommerce-plugin-7-1-1-sensitive-data-exposure-vulnerability?_s_id=cve)