Authorization Bypass Vulnerability in Order Delivery Date Plugin by WordPress
CVE-2025-2907
Key Information:
- Vendor
- WordPress
- Status
- Vendor
- CVE Published:
- 26 April 2025
Badges
Summary
The Order Delivery Date WordPress plugin, prior to version 12.3.1, is susceptible to an authorization bypass that allows attackers to manipulate site settings. This vulnerability arises due to the absence of adequate authorization and CSRF checks during the import of plugin settings. Consequently, attackers could exploit this flaw to alter critical options, such as changing the default user role to 'administrator' and enabling user registration as an administrator. This breach can lead to a complete takeover of the site, compromising its security and integrity.
Affected Version(s)
Order Delivery Date 2.0 < 12.3.1
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.
References
Timeline
- 🟡
Public PoC available
- 👾
Exploit known to exist
Vulnerability published
Vulnerability Reserved