CVE-2025-2907
📋 TL;DR
This vulnerability in the Order Delivery Date WordPress plugin allows unauthenticated attackers to modify critical WordPress settings, including registering themselves as administrators. It affects all WordPress sites running vulnerable versions of this plugin. Attackers can achieve complete site takeover through this flaw.
💻 Affected Systems
- Order Delivery Date for WooCommerce WordPress plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete site compromise with administrative access, data theft, defacement, malware injection, and potential lateral movement to other systems.
Likely Case
Attacker gains administrative access, installs backdoors, steals sensitive data, and uses the compromised site for further attacks.
If Mitigated
Attack prevented through proper patching or workarounds, with no impact to site integrity.
🎯 Exploit Status
Exploitation requires no authentication and minimal technical skill due to missing authorization/CSRF checks.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 12.3.1
Vendor Advisory: https://wpscan.com/vulnerability/2e513930-ec01-4dc6-8991-645c5267e14c/
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find 'Order Delivery Date for WooCommerce'. 4. Click 'Update Now' if available, or download version 12.3.1+ from WordPress repository. 5. Activate updated plugin.
🔧 Temporary Workarounds
Disable vulnerable plugin
allTemporarily deactivate the Order Delivery Date plugin until patched
wp plugin deactivate order-delivery-date
Restrict plugin access
allUse web application firewall to block requests to plugin import functionality
🧯 If You Can't Patch
- Disable the Order Delivery Date plugin immediately
- Implement strict network segmentation and monitor for unauthorized admin user creation
🔍 How to Verify
Check if Vulnerable:
Check plugin version in WordPress admin under Plugins > Installed Plugins. If version is below 12.3.1, you are vulnerable.Check Version:
wp plugin get order-delivery-date --field=versionVerify Fix Applied:
Confirm plugin version is 12.3.1 or higher in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- Unauthorized POST requests to plugin import endpoints
- Sudden creation of new administrator accounts
- Changes to default_user_role or users_can_register settings
Network Indicators:
- HTTP requests to /wp-admin/admin-ajax.php with action=orddd_import_settings
- Unusual traffic patterns to plugin-specific endpoints
SIEM Query:
source="wordpress.log" AND ("orddd_import_settings" OR "default_user_role" OR "users_can_register")