CVE-2025-2907
Published: 26 April 2025
Summary
CVE-2025-2907 is a critical-severity CSRF (CWE-352) vulnerability in Tychesoftwares Order Delivery Date Pro For Woocommerce. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 8.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
The Order Delivery Date WordPress plugin before version 12.3.1 is affected by missing authorization and CSRF checks on its settings import functionality. The plugin also lacks validation to restrict option updates to only those relevant to the plugin itself, which permits modification of arbitrary WordPress settings including default_user_role and users_can_register.
Unauthenticated attackers can exploit the flaw over the network to change the default role to administrator and enable open registration, then create an administrative account for full site takeover. The vulnerability is tracked as CVE-2025-2907 with a CVSS 3.1 score of 9.8 and is categorized under CWE-352.
WPScan advisories at the referenced URLs describe the issue and indicate that updating to version 12.3.1 or later mitigates the exposure. The associated EPSS score shows a peak of 0.0978 against a current value of 0.0718.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-12492
Vulnerability details
The Order Delivery Date WordPress plugin before 12.3.1 does not have authorization and CSRF checks when importing settings. Furthermore it also lacks proper checks to only update options relevant to the Order Delivery Date WordPress plugin before 12.3.1. This leads…
more
to attackers being able to modify the default_user_role to administrator and users_can_register, allowing them to register as an administrator of the site for complete site takeover.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Awareness training educates users on avoiding untrusted links and actions that can be exploited via CSRF.
Requiring user re-entry of credentials for sensitive actions prevents automated forgery of requests without active user participation.
Security testing regimens explicitly include checks for missing or ineffective anti-CSRF protections in web applications.
Detects anomalous request patterns consistent with cross-site request forgery.