VulnerabilityAnalyzed
CVE-2025-2942
The Order Delivery Date WordPress plugin before 12.6.0 discloses arbitrary post title (such as from draft and private posts) via an unauthenticated AJAX action, allowing attackers to retrieve such information
MEDIUM 4.3EPSS 0.26%
Does this matter?
Lower severity and a low EPSS score (0.26%). Track it; it rarely justifies an emergency change on its own.
Description
The Order Delivery Date WordPress plugin before 12.6.0 discloses arbitrary post title (such as from draft and private posts) via an unauthenticated AJAX action, allowing attackers to retrieve such information
- CVSS 3.1
- 4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
- EPSS
- 0.26% probability · 17th percentile
- CISA KEV
- Not listed
- Affected
- tychesoftwares/order delivery date for woocommerce
- Source
- contact@wpscan.com
References
- https://wpscan.com/vulnerability/13a87567-2cf7-4bfb-8d63-a8e74950978f/Exploit, Third Party Advisory
- https://wpscan.com/vulnerability/13a87567-2cf7-4bfb-8d63-a8e74950978f/Exploit, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.