The Order Delivery Date WordPress plugin before 12.3.1 does not have authorization and CSRF checks when importing settings. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
PHP
WordPress
CSRF
Order Delivery Date Pro For Woocommerce
Tychesoftwares
NVD
WPScan
CVSS 3.1
9.8
EPSS
9.8%