Skip to content
Threat Feed
Subscribe
critical advisory

Tychesoftwares Order Delivery Date Pro for WooCommerce: Privilege Escalation (CVE-2025-2907)

A missing authorization vulnerability in Tychesoftwares Order Delivery Date Pro for WooCommerce allows unauthenticated attackers to modify site options, facilitating privilege escalation via account takeover.

CVE search metadata

CVE search record: CVE-2025-2907. Severity: critical. CVSS: 9.8. EPSS: 1.41%. KEV: no. Product: Order Delivery Date Pro For Woocommerce (< 12.3.1). Brief: Tychesoftwares Order Delivery Date Pro for WooCommerce: Privilege Escalation (CVE-2025-2907). Brief link: https://feed.craftedsignal.io/briefs/2026-11-cve-2025-2907/

Triage facts

Revision 1
Applicability
Order Delivery Date Pro For Woocommerce (< 12.3.1)
Evidence
Unknown
Severity
Critical
Action
Elevated
Sources
3 public sources
Freshness
Revision 1Nov 1, 07:59 UTC
Detection
1 rule
Vulnerabilities
1 CVE
Source quality
B2Likely

Tychesoftwares Order Delivery Date Pro for WooCommerce versions prior to 12.3.1 are vulnerable to a missing authorization flaw (CVE-2025-2907). The vulnerability exists in the 'orddd-import-file' action, which fails to perform proper capability checks. An unauthenticated attacker can exploit this to update arbitrary WordPress site options. By modifying the site's default user registration role to 'administrator' and enabling user registrations, an attacker can create an administrative account, resulting in full site compromise.

Impact

Successful exploitation allows unauthenticated attackers to gain administrative privileges on affected WordPress sites by modifying site options to enable arbitrary user registration and elevated account roles.

Recommendation

  • Update Tychesoftwares Order Delivery Date Pro for WooCommerce to version 12.3.1 or later immediately.
  • Audit WordPress site options for unauthorized changes to registration settings, specifically 'users_can_register' and 'default_role'.
  • Monitor server access logs for anomalous POST requests targeting the 'orddd-import-file' action.

Immediate actions

Upgrade Tychesoftwares Order Delivery Date Pro for WooCommerce to 12.3.1 or later

IT Operations 24h

Threat Hunt

Search web logs for POST requests containing action=orddd-import-file

T1190 high high confidence convert to detection

Data: webserver logs

Mitigations

Upgrade plugin to version 12.3.1

immediate IT Operations

CVE-2025-2907

Detection coverage 1

Detects CVE-2025-2907 Exploitation - Unauthenticated option modification

critical

Detects exploitation of CVE-2025-2907 via HTTP POST requests to the orddd-import-file endpoint used to modify arbitrary WordPress options

sigma tactics: initial_access, privilege_escalation techniques: T1190 sources: webserver

Detection queries are available on the platform. Get full rules →