CVE-2025-2942

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-2942
The Order Delivery Date WordPress plugin before 12.6.0 discloses arbitrary post title (such as from draft and private posts) via an unauthenticated AJAX action, allowing attackers to retrieve such information

4.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://wpscan.com/vulnerability/13a87567-2cf7-4bfb-8d63-a8e74950978f/ Exploit Third Party Advisory
https://wpscan.com/vulnerability/13a87567-2cf7-4bfb-8d63-a8e74950978f/ Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:tychesoftwares:order_delivery_date_for_woocommerce:*:*:*:*:*:wordpress:*:*
History

17 Jul 2025, 00:59

Type Values Removed Values Added
First Time Tychesoftwares order Delivery Date For Woocommerce
Tychesoftwares
References () https://wpscan.com/vulnerability/13a87567-2cf7-4bfb-8d63-a8e74950978f/ - () https://wpscan.com/vulnerability/13a87567-2cf7-4bfb-8d63-a8e74950978f/ - Exploit, Third Party Advisory
CWE NVD-CWE-noinfo
CPE cpe:2.3:a:tychesoftwares:order_delivery_date_for_woocommerce:*:*:*:*:*:wordpress:*:*

15 Jul 2025, 14:15

Type Values Removed Values Added
References () https://wpscan.com/vulnerability/13a87567-2cf7-4bfb-8d63-a8e74950978f/ - () https://wpscan.com/vulnerability/13a87567-2cf7-4bfb-8d63-a8e74950978f/ -
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 4.3

15 Jul 2025, 13:14

Type Values Removed Values Added
Summary
  • (es) El complemento Order Delivery Date de WordPress anterior a la versión 12.6.0 revela títulos de publicaciones arbitrarios (como borradores y publicaciones privadas) a través de una acción AJAX no autenticada, lo que permite a los atacantes recuperar dicha información.

11 Jul 2025, 06:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-07-11 06:15

Updated : 2025-07-17 00:59

NVD link : CVE-2025-2942

Mitre link : CVE-2025-2942

CVE.ORG link : CVE-2025-2942

JSON object : View

Products Affected

tychesoftwares

  • order_delivery_date_for_woocommerce
CWE
NVD-CWE-noinfo