CRITICAL🇵🇱 Wersja polska

CVE-2025-2907

CVSS 9.8v3.1pub. 2025-04-26upd. 2025-05-14

The Order Delivery Date WordPress plugin before 12.3.1 does not have authorization and CSRF checks when importing settings. Furthermore it also lacks proper checks to only update options relevant to the Order Delivery Date WordPress plugin before 12.3.1. This leads to attackers being able to modify the default_user_role to administrator and users_can_register, allowing them to register as an administrator of the site for complete site takeover.

🤖 AI Analysis
How it works

The plugin settings import endpoint does not require authentication or check CSRF tokens, allowing any user — including unauthenticated ones — to send a crafted HTTP request. Additionally, the lack of filtering on updated options allows modification of any WordPress parameters beyond the plugin's scope. An attacker can set the 'default_user_role' option to 'administrator' and enable 'users_can_register', which allows them to register an account with site administrator privileges.

Impact

An attacker can obtain full WordPress administrator privileges, leading to complete site takeover — including installation of malicious software, theft of user data, and modification or deletion of website content.

Mitigation & patch

The Order Delivery Date for WordPress plugin must be immediately updated to version 12.3.1 or newer. It is also recommended to check the list of website users for unauthorized administrator accounts and reset the 'default_user_role' and 'users_can_register' options to secure values.

Who is affected

Order Delivery Date for WordPress plugin (Tychesoftwares) in versions before 12.3.1

Analysis generated by Claude AI (Anthropic) based on NVD data. Always verify with vendor.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Tychesoftwares Order Delivery Date Pro For Woocommerce

    APP
    Tychesoftwares
    < 12.3.1
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2023-2986CRITICAL9.8ten sam vendor

The Abandoned Cart Lite for WooCommerce plugin for WordPress is vulnerable to authentication bypass in version...

CVE-2025-2929HIGH7.1ten sam vendor

The Order Delivery Date WordPress plugin before 12.4.0 does not sanitise and escape a parameter before outputt...

CVE-2024-13359HIGH8.1ten sam vendor

The Product Input Fields for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to i...

CVE-2023-41874HIGH7.1ten sam vendor

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Tyche Softwares Order Delivery Date for WooComme...

CVE-2019-25152HIGH7.2ten sam vendor

The Abandoned Cart Lite for WooCommerce and Abandoned Cart Pro for WooCommerce plugins for WordPress are vulne...