PT-2025-17953 · WordPress · Order Delivery Date

Mike Gozdiskowski · Published 2025-04-26 · Updated 2025-05-14 · CVE-2025-2907

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Order Delivery Date WordPress plugin versions prior to 12.3.1

Description The issue concerns a lack of authorization and CSRF checks when importing settings in the Order Delivery Date WordPress plugin. This allows attackers to modify sensitive options, such as default user role to administrator and users can register, enabling them to register as an administrator of the site and gain complete control.

Recommendations For versions prior to 12.3.1, update to version 12.3.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the settings import functionality until a patch is applied. Additionally, monitor user registrations and role assignments closely to detect any potential malicious activity.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2025-2907

Affected Products

Order Delivery Date

References · 11

• 🔥 https://wpscan.com/vulnerability/2e513930-ec01-4dc6-8991-645c5267e14c · Exploit
• https://osv.dev/vulnerability/CVE-2025-2907 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-2907 · Security Note
• https://t.me/cvedetector/23795 · Telegram Post
• https://twitter.com/CVEnew/status/1916020725212659792 · Twitter Post
• https://t.me/cvenotify/119902 · Telegram Post
• https://twitter.com/cracbot/status/1917896848049611187 · Twitter Post
• https://t.me/cvenotify/122209 · Telegram Post
• https://twitter.com/pdnuclei_bot/status/1918274290488840241 · Twitter Post
• https://twitter.com/dailycve/status/1922765053251449293 · Twitter Post
• https://t.me/cvetracker/22410 · Telegram Post