CVE-2025-63024

MediumCVSS 5.4

Published: 09/12/2025(UTC)Updated: 07/10/2026(UTC)Translated: 01/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.23%

12th percentile - higher than 12% of all known CVEs

Summary

The Order Delivery Date for WooCommerce plugin (versions up to and including 4.3.1) contains a Missing Authorization vulnerability. It allows exploitation of incorrectly configured access control security levels.

Risk Assessment

An attacker could perform unauthorized actions in the WooCommerce store, potentially leading to data or settings modification.

Recommendation

Update the Order Delivery Date for WooCommerce plugin to the latest version. If not possible, consider disabling it.

Other vulnerabilities in Order Delivery Date for WooCommerce

CVE-2026-65559High
Shop manager Privilege Escalation in Order Delivery Date for WooCommerce versions up to 4.6.0.

Original NVD description (English source)

Missing Authorization vulnerability in tychesoftwares Order Delivery Date for WooCommerce order-delivery-date-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Order Delivery Date for WooCommerce: from n/a through <= 4.3.1.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS