CVE-2026-110191: Product Delivery Date for WooCommerce – Lite < 3.3.2 - Contributor+ Order Information Disclosure via Calendar View AJAX Actions

Q: Which users can exploit this issue?

Any authenticated WordPress user with at least the Contributor role can access the affected calendar-view AJAX actions and view other customers’ order information.

Q: Are unauthenticated visitors affected?

The available information identifies Contributor-level access as the lowest affected role. It does not state that unauthenticated users can exploit the issue.

Q: Which versions require remediation?

Product Delivery Date for WooCommerce – Lite versions earlier than 3.3.2 are affected. Updating to version 3.3.2 or later addresses the missing capability check described.

Published Oct 16, 2026

Updated

The Product Delivery Date for WooCommerce WordPress plugin before 3.3.2 does not perform a capability check before disclosing order details through its calendar view AJAX actions, allowing users with a role as low as Contributor to view other customers' order information.

Affected Software

1 affected component

Tyche Softwares Product Delivery Date for WooCommerce – Lite<3.3.2

Event History

Oct 16, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Which users can exploit this issue?

Any authenticated WordPress user with at least the Contributor role can access the affected calendar-view AJAX actions and view other customers’ order information.

Are unauthenticated visitors affected?

The available information identifies Contributor-level access as the lowest affected role. It does not state that unauthenticated users can exploit the issue.

Which versions require remediation?

Product Delivery Date for WooCommerce – Lite versions earlier than 3.3.2 are affected. Updating to version 3.3.2 or later addresses the missing capability check described.

CVE-2026-110191: Product Delivery Date for WooCommerce – Lite < 3.3.2 - Contributor+ Order Information Disclosure via Calendar View AJAX Actions

Affected Software

Event History

Frequently Asked Questions

Which users can exploit this issue?

Are unauthenticated visitors affected?

Which versions require remediation?

Company

Resources

Contact

Frequently Asked Questions

Which users can exploit this issue?

Are unauthenticated visitors affected?

Which versions require remediation?