CVE-2025-2942

Order Delivery Date Pro for WooCommerce < 12.6.0 - Unauthenticated Arbitrary Post Title Disclosure

The Order Delivery Date WordPress plugin before 12.6.0 discloses arbitrary post title (such as from draft and private posts) via an unauthenticated AJAX action, allowing attackers to retrieve such information

Affected

Order Delivery Date

CVSS v3.1 CNA

4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

EPSS

0.30% chance of exploitation in the next 30 days, 21st percentile

Published

2025-07-11

Updated

2025-07-15

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/13a87567-2cf7-4bfb-8d63-a8e74950978f/

Security advisories

• https://wpscan.com/vulnerability/13a87567-2cf7-4bfb-8d63-a8e74950978f

References

• CVE Record
• NVD entry