CVE-2025-2942

Order Delivery Date Pro for WooCommerce < 12.6.0 - Unauthenticated Arbitrary Post Title Disclosure

CVSS 4.3 MEDIUMEPSS 0.3%

Vexday Risk Score

13Bajo

Decisión SSVC (CISA)

Track

Sin señal de explotación → monitorear

CVSS 4.3EPSS 0.3%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

11 jul 2025Publicada en NVD

Recomendación: Monitorear — sin señal de explotación por ahora.

The Order Delivery Date WordPress plugin before 12.6.0 discloses arbitrary post title (such as from draft and private posts) via an unauthenticated AJAX action, allowing attackers to retrieve such information

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Productos afectados

Unknown · Order Delivery Date

Referencias

https://wpscan.com/vulnerability/13a87567-2cf7-4bfb-8d63-a8e74950978f/