CVE-2025-2907: Order Delivery Date Pro for WooCommerce < 12.3.1 - Unauthenticated Arbitrary Option Update
First published: Sat Apr 26 2025(Updated: )
The Order Delivery Date WordPress plugin before 12.3.1 does not have authorization and CSRF checks when importing settings. Furthermore it also lacks proper checks to only update options relevant to the Order Delivery Date WordPress plugin before 12.3.1. This leads to attackers being able to modify the default_user_role to administrator and users_can_register, allowing them to register as an administrator of the site for complete site takeover.
Credit: contact@wpscan.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| WooCommerce Order Delivery Date | <12.3.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the severity of CVE-2025-2907?
CVE-2025-2907 is rated as a medium severity vulnerability due to its impact on the security of the Order Delivery Date WordPress plugin.
How do I fix CVE-2025-2907?
To fix CVE-2025-2907, update the Order Delivery Date WordPress plugin to version 12.3.1 or later.
What are the potential risks of CVE-2025-2907?
The risks of CVE-2025-2907 include unauthorized access and manipulation of plugin settings, potentially leading to broader site vulnerabilities.
Which versions are affected by CVE-2025-2907?
CVE-2025-2907 affects all versions of the Order Delivery Date WordPress plugin prior to 12.3.1.
Does CVE-2025-2907 affect other plugins or software?
CVE-2025-2907 specifically affects the Order Delivery Date WordPress plugin and does not impact other plugins.
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/references
- agent/type
- agent/weakness
- agent/description
- agent/first-publish-date
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/softwarecombine
- agent/author
- agent/source
- agent/tags
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- agent/severity
- agent/event
- vendor/woocommerce
- canonical/woocommerce order delivery date