Cpe:2.3:a:tychesoftwares:order_delivery_date_pro_for_woocommerce:*:*:*:*:*:wordpress:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3atychesoftwaresorder_delivery_date_pro_for_woocommercewordpress/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSun, 01 Nov 2026 07:59:11 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgTychesoftwares Order Delivery Date Pro for WooCommerce: Privilege Escalation (CVE-2025-2907)https://feed.craftedsignal.io/briefs/2026-11-cve-2025-2907/Sun, 01 Nov 2026 07:59:11 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-cve-2025-2907/A missing authorization vulnerability in Tychesoftwares Order Delivery Date Pro for WooCommerce allows unauthenticated attackers to modify site options, facilitating privilege escalation via account takeover.Tychesoftwares Order Delivery Date Pro for WooCommerce versions prior to 12.3.1 are vulnerable to a missing authorization flaw (CVE-2025-2907). The vulnerability exists in the 'orddd-import-file' action, which fails to perform proper capability checks. An unauthenticated attacker can exploit this to update arbitrary WordPress site options. By modifying the site's default user registration role to 'administrator' and enabling user registrations, an attacker can create an administrative account, resulting in full site compromise.

Impact

Successful exploitation allows unauthenticated attackers to gain administrative privileges on affected WordPress sites by modifying site options to enable arbitrary user registration and elevated account roles.

Recommendation

  • Update Tychesoftwares Order Delivery Date Pro for WooCommerce to version 12.3.1 or later immediately.
  • Audit WordPress site options for unauthorized changes to registration settings, specifically 'users_can_register' and 'default_role'.
  • Monitor server access logs for anomalous POST requests targeting the 'orddd-import-file' action.
]]>criticaladvisory