CVE-2025-2907 - Order Delivery Date Pro for WooCommerce < 12.3.1 - Unauthenticated Arbitrary Option Update

Back Back to CVE browser

CRITICAL

Order Delivery Date Pro for WooCommerce < 12.3.1 - Unauthenticated Arbitrary Option Update

Published Apr 26, 2025

9.8

CRITICAL

CVSS 3.1

EPSS 1.39%

Description

The Order Delivery Date WordPress plugin before 12.3.1 does not have authorization and CSRF checks when importing settings. Furthermore it also lacks proper checks to only update options relevant to the Order Delivery Date WordPress plugin before 12.3.1. This leads to attackers being able to modify the default_user_role to administrator and users_can_register, allowing them to register as an administrator of the site for complete site takeover.

Affected products

Vendor n/a Product Order Delivery Date Default
unaffected
- Version
  2.0
  Status
  affected
  Constraints
  <12.3.1

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Order Delivery Date

unaffected

Version	Status	Constraints
2.0	affected	<12.3.1

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-352

CSRF

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-12492
Advisory
https://wpscan.com/vulnerability/2e513930-ec01-4dc6-8991-645c5267e14c/
exploitvdb-entrytechnical-descriptionThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-12492		Advisory
https://wpscan.com/vulnerability/2e513930-ec01-4dc6-8991-645c5267e14c/		exploitvdb-entrytechnical-descriptionThird Party Advisory