Skip to content
Sign in
4.3 Medium

CVE-2025-2942 The Order Delivery Date WordPress plugin before 12.6.0 discloses arbitrary post title (such as from draft and private…

Description

The Order Delivery Date WordPress plugin before 12.6.0 discloses arbitrary post title (such as from draft and private posts) via an unauthenticated AJAX action, allowing attackers to retrieve such information

Affected products and versions

Product Affected versions Fixed in
Order Delivery Date 2.0 2.0 → < 12.6.0 12.6.0

Other CVEs of Order Delivery Date

The 3 CVEs of Order Delivery Date →
CVE-2025-2929 The Order Delivery Date WordPress plugin before 12.4.0 does not sanitise and escape a parameter before outputting it… 7.1 High CVE-2025-2907 The Order Delivery Date WordPress plugin before 12.3.1 does not have authorization and CSRF checks when importing… 9.8 Critical
Track this CVE