CVE-2025-2942

The Order Delivery Date WordPress plugin before 12.6.0 discloses arbitrary post title (such as from draft and private posts) via an unauthenticated AJAX action, allowing attackers to retrieve such information

CVSS v3.1

4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

EPSS

0.26% chance of exploitation in the next 30 days, 17th percentile

Published

2025-07-11

Updated

2025-07-15

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/13a87567-2cf7-4bfb-8d63-a8e74950978f/

References

• CVE Record
• NVD entry

Related

• CVE-2025-29390
• CVE-2025-29425
• CVE-2025-29387
• CVE-2025-29426
• CVE-2025-29386
• CVE-2025-29429