CVE-2025-2942: Tychesoftwares Order Delivery Date For Woocommerce

Medium severity, CVSS 4.3. EPSS: 0.3% chance of exploitation in the next 30 days.

The Order Delivery Date WordPress plugin before 12.6.0 discloses arbitrary post title (such as from draft and private posts) via an unauthenticated AJAX action, allowing attackers to retrieve such information

Affected products

• Tychesoftwares Order Delivery Date For Woocommerce: before 12.6.0 (fixed in 12.6.0)

Published 2025-07-11. Last modified 2026-06-17.