Order Delivery Date CVE-2026-65559

Exploitation requires an authenticated WordPress session with at minimum the shop manager role on a site running Order Delivery Date for WooCommerce version 4.6.0 or earlier. The CVSS PR:H metric confirms that unauthenticated access is not sufficient - a valid shop manager account must exist and be accessible to the attacker. There is no requirement for special server-side configurations beyond the vulnerable plugin being active. What limits exploitation is the prerequisite of possessing or compromising a shop manager credential; sites that grant this role only to a small number of highly trusted users face substantially lower realistic risk. No specific WooCommerce feature toggle or non-default configuration is cited as an enabling condition - the flaw is present in the plugin's default installed state.

The CVSS score of 7.2 with vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H reflects a network-exploitable, low-complexity flaw requiring high privileges - specifically, a valid shop manager account. The High Confidentiality, Integrity, and Availability impact scores indicate that successful exploitation grants near-total control over the WordPress site. Despite the high-impact triad, the PR:H constraint substantially narrows real-world risk: an attacker must first possess or compromise a shop manager credential, which is not a default or anonymous condition. EPSS data is not provided, and the vulnerability carries no CISA KEV listing and no known POC, further reducing the likelihood of opportunistic mass exploitation. The realistic threat actor is a malicious insider, a disgruntled employee with shop manager access, or an attacker who has already compromised that specific account tier. For organizations that grant shop manager roles to multiple or external users (e.g., dropshipping partners, contractors), the risk is materially higher.

An attacker who holds or has stolen a shop manager account - perhaps a former employee or a contractor whose credentials were not revoked - authenticates to the WordPress admin panel and submits a crafted request to a plugin endpoint that performs insufficient capability verification. The incorrect privilege assignment flaw elevates the session to administrator level, enabling the attacker to install malicious plugins, create new administrator accounts, exfiltrate customer order data, or fully deface the storefront.