TI-2025-02538 Aliases CVE-2025-2907 GHSA-f24m-7jrp-68fr

Order Delivery Date Pro for WooCommerce < 12.3.1 - Unauthenticated Arbitrary Option Update

HIGH 82CWE-352Published 2025-04-26 · Updated 2025-04-29

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Tampering
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-352.

Summary

The Order Delivery Date WordPress plugin before 12.3.1 does not have authorization and CSRF checks when importing settings. Furthermore it also lacks proper checks to only update options relevant to the Order Delivery Date WordPress plugin before 12.3.1. This leads to attackers being able to modify the default_user_role to administrator and users_can_register, allowing them to register as an administrator of the site for complete site takeover.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.01412 72nd percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by the CNA and NVD

Fix Fixed Order Delivery Date (Unknown): 12.3.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: Yes
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Unknown	Order Delivery Date	2.0 to before 12.3.1	12.3.1	Patch available	CNA

Order Delivery Date VendorUnknown Affected 2.0 to before 12.3.1 Fixed in 12.3.1 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:tychesoftwares:order_delivery_date_pro_for_woocommerce::::::wordpress::*	before 12.3.1	Vulnerable	tychesoftwares

cpe:2.3:a:tychesoftwares:order_delivery_date_pro_for_woocommerce:*:*:*:*:*:wordpress:*:* Versions before 12.3.1 Vulnerable ·tychesoftwares

Remediation

Fix · CNA Order Delivery Date (Unknown) Fixed in 12.3.1

Timeline

2026-10-02 Threatist record created from CVE-2025-2907
2026-10-03 Alias added: GHSA-f24m-7jrp-68fr

References

Exploit 1

https://wpscan.com/vulnerability/2e513930-ec01-4dc6-8991-645c5267e14c/

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences