CVE-2025-2907: Order Delivery Date Pro for WooCommerce < 12.3.1 - Unauthenticated Arbitrary Option Update
The Order Delivery Date WordPress plugin before 12.3.1 does not have authorization and CSRF checks when importing settings. Furthermore it also lacks proper checks to only update options relevant to the Order Delivery Date WordPress plugin before 12.3.1. This leads to attackers being able to modify the defaultuserrole to administrator and userscanregister, allowing them to register as an administrator of the site for complete site takeover.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-2907?
CVE-2025-2907 is rated as a medium severity vulnerability due to its impact on the security of the Order Delivery Date WordPress plugin.
How do I fix CVE-2025-2907?
To fix CVE-2025-2907, update the Order Delivery Date WordPress plugin to version 12.3.1 or later.
What are the potential risks of CVE-2025-2907?
The risks of CVE-2025-2907 include unauthorized access and manipulation of plugin settings, potentially leading to broader site vulnerabilities.
Which versions are affected by CVE-2025-2907?
CVE-2025-2907 affects all versions of the Order Delivery Date WordPress plugin prior to 12.3.1.
Does CVE-2025-2907 affect other plugins or software?
CVE-2025-2907 specifically affects the Order Delivery Date WordPress plugin and does not impact other plugins.