EUVD-2026-36813
GHSA-6xg5-89c9-843g
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
Network-reachable, no auth and no interaction (AV:N/AC:L/PR:N/UI:N); SQLi typically allows some writes so I:L rather than I:N; scope changes because plugin SQLi reaches the shared WP/Woo database.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
Lifecycle Timeline
2DescriptionCVE.org
Unauthenticated SQL Injection in Order Delivery Date for WooCommerce <= 4.5.1 versions.
Articles & Coverage 1
AnalysisAI
SQL injection in the Tyche Softwares 'Order Delivery Date for WooCommerce' WordPress plugin (versions up to and including 4.5.1) allows unauthenticated remote attackers to inject arbitrary SQL into backend queries. Per the CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L) the flaw is network-reachable, requires no privileges or interaction, and results in a scope change with high confidentiality impact and partial availability impact. No public exploit identified at time of analysis, but Patchstack tracking and the CWE-89 classification put this in a well-understood, easily weaponizable bug class for WordPress sites.
Technical ContextAI
The affected component is the 'Order Delivery Date for WooCommerce' plugin by Tyche Softwares (CPE cpe:2.3:a:tychesoftwares:order_delivery_date_for_woocommerce), an add-on that lets WooCommerce stores accept delivery date/time selections at checkout. CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) indicates that user-controlled input - likely a date, time slot, order, or checkout parameter - is concatenated into a SQL query against the WordPress database (typically MySQL/MariaDB via $wpdb) without proper use of prepared statements or wpdb->prepare() placeholders. Because WordPress plugins share the site's database connection with full access to wp_users, wp_usermeta, wp_options, and WooCommerce order tables, a successful injection reaches sensitive data well beyond the plugin's own scope, which is consistent with the S:C (scope changed) flag in the CVSS vector.
RemediationAI
Upstream fix available per Patchstack advisory; released patched version not independently confirmed from the data provided, so administrators should consult the Patchstack entry (https://patchstack.com/database/wordpress/plugin/order-delivery-date-for-woocommerce/vulnerability/wordpress-order-delivery-date-for-woocommerce-plugin-4-5-1-sql-injection-vulnerability) and the plugin's WordPress.org page to confirm and install the latest version above 4.5.1. Until the upgrade is applied, deactivate and remove the 'Order Delivery Date for WooCommerce' plugin (this disables delivery date selection at checkout, which may affect order fulfillment workflows), or place the site behind a WAF such as Patchstack, Wordfence, or Cloudflare with virtual-patching rules for this CVE - note that generic SQLi WAF rules can produce false positives on legitimate date parameters. As a defense-in-depth measure, audit wp_users for unexpected admin accounts and rotate WordPress salts, database credentials, and any API keys stored in wp_options, since unauthenticated SQLi may have allowed exfiltration prior to patching.
The Order Delivery Date WordPress plugin before 12.4.0 does not sanitise and escape a parameter before outputting it bac
Cross-Site Request Forgery (CSRF) vulnerability in Ashok Rane Order Delivery Date for WP e-Commerce plugin <= 1.2 versio
A security vulnerability in Order Delivery Date WordPress (CVSS 4.3). Risk factors: public PoC available.
Unauth. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low at
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today