{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3atychesoftwaresorder_delivery_date_pro_for_woocommercewordpress/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:tychesoftwares:order_delivery_date_pro_for_woocommerce:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2025-2907"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Order Delivery Date Pro For Woocommerce (\u003c 12.3.1)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Tychesoftwares"],"content_html":"\u003cp\u003eTychesoftwares Order Delivery Date Pro for WooCommerce versions prior to 12.3.1 are vulnerable to a missing authorization flaw (CVE-2025-2907). The vulnerability exists in the 'orddd-import-file' action, which fails to perform proper capability checks. An unauthenticated attacker can exploit this to update arbitrary WordPress site options. By modifying the site's default user registration role to 'administrator' and enabling user registrations, an attacker can create an administrative account, resulting in full site compromise.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated attackers to gain administrative privileges on affected WordPress sites by modifying site options to enable arbitrary user registration and elevated account roles.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate Tychesoftwares Order Delivery Date Pro for WooCommerce to version 12.3.1 or later immediately.\u003c/li\u003e\n\u003cli\u003eAudit WordPress site options for unauthorized changes to registration settings, specifically 'users_can_register' and 'default_role'.\u003c/li\u003e\n\u003cli\u003eMonitor server access logs for anomalous POST requests targeting the 'orddd-import-file' action.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-01T07:59:11Z","date_published":"2026-11-01T07:59:11Z","id":"https://feed.craftedsignal.io/briefs/2026-11-cve-2025-2907/","summary":"A missing authorization vulnerability in Tychesoftwares Order Delivery Date Pro for WooCommerce allows unauthenticated attackers to modify site options, facilitating privilege escalation via account takeover.","title":"Tychesoftwares Order Delivery Date Pro for WooCommerce: Privilege Escalation (CVE-2025-2907)","url":"https://feed.craftedsignal.io/briefs/2026-11-cve-2025-2907/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:tychesoftwares:order_delivery_date_pro_for_woocommerce:*:*:*:*:*:wordpress:*:*","version":"https://jsonfeed.org/version/1.1"}