Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
2.7
CVE-2026-110191: WooCommerce delivery plugin lets contributors see other orders
CVE-2026-110191 · published 2 days ago
Summary
The Product Delivery Date plugin for WooCommerce can show order details to users who only have the Contributor role. This means people who should not see customer information could view it through the calendar screen. Update the plugin to version 3.3.2 or later, or limit access to the calendar feature, to stop the exposure.
What to do
- Update unknown product delivery date for woocommerce to version 3.3.2 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| unknown | product delivery date for woocommerce | < 3.3.2 |
Original advisory text
Product Delivery Date for WooCommerce – Lite < 3.3.2 - Contributor+ Order Information Disclosure via Calendar View AJAX Actions
The Product Delivery Date for WooCommerce WordPress plugin before 3.3.2 does not perform a capability check before disclosing order details through its calendar view AJAX actions, allowing users with a role as low as Contributor to view other customers' order information.
References
- https://wpscan.com/vulnerability/d7310c1a-f858-4dc5-8102-813fb64096a6/ exploit vdb-entry technical-description
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
2.7
Low
Type
CWE-200Information Exposure
Timeline
Published16 Oct 2026
Updated17 Oct 2026
First seen16 Oct 2026
Track software like this
Free during beta