PatchTheCVECVE-2025-2907: The Order Delivery Date WordPress plugin before 12.3.1 does not have authorization and CSRF checks when import
CVE-2025-2907 is a critical-severity flaw (CVSS 9.8) affecting order delivery date pro for woocommerce. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
The Order Delivery Date WordPress plugin before 12.3.1 does not have authorization and CSRF checks when importing settings. Furthermore it also lacks proper checks to only update options relevant to the Order Delivery Date WordPress plugin before 12.3.1. This leads to attackers being able to modify the default_user_role to administrator and users_can_register, allowing them to register as an administrator of the site for complete site takeover.
Why this priority
- Critical severity
- Public exploit reference
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 9.8 (Critical) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 1.4% (top 27%) |
| CISA exploited list | No |
| Weakness | CWE-352 |
| Published | 2025-04-26 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Public exploits and detection
Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.
- Nuclei scan template: Order Delivery Date Pro for WooCommerce < 12.3.1 - Arbitrary Option Update
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2025-2907?
order delivery date pro for woocommerce: upgrade to 12.3.1. Exact commands for each OS are on this page.
Is CVE-2025-2907 being exploited?
CVE-2025-2907 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2025-2907 affect?
CVE-2025-2907 affects order delivery date pro for woocommerce. Severity is critical (CVSS 9.8). The Order Delivery Date WordPress plugin before 12.3.1 does not have authorization and CSRF checks when importing settings. Furthermore it also lacks proper checks to only update options relevant to the Order Delivery Date WordPress plugin
How urgent is CVE-2025-2907?
Priority 62/100. Critical severity; Public exploit reference; Remotely exploitable, no login, no user action
Software pages
WordPress vulnerabilities · WooCommerce vulnerabilities