What is the CVSS score of CVE-2026-65559?

CVE-2026-65559 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Order Delivery Date are affected by CVE-2026-65559?

Order Delivery Date for WooCommerce (versions through 4.6.0) allows authorized shop managers to escalate their access privileges to full site administrator level.

How to fix or mitigate CVE-2026-65559?

Within 24 hours, audit all active shop manager accounts and disable those belonging to terminated or untrusted personnel; enable enhanced WordPress admin logging to detect privilege escalation attempts. Within 7 days, inventory all WooCommerce installations running Order Delivery Date plugin version 4.6.0 or earlier and establish a patching timeline; restrict shop manager role assignment to essential personnel only pending remediation. Within 30 days, upgrade Order Delivery Date for WooCommerce to the latest available version once the vendor releases a patched build; implement multi-factor authentication (MFA) for all shop manager and administrator accounts; conduct a review of WordPress role-based access controls across all installations to minimize the number of privileged accounts.

Order Delivery Date CVE-2026-65559

EUVD-2026-53984 HIGH

Incorrect Privilege Assignment (CWE-266)

2026-08-06 Patchstack

GHSA-76fm-xcxx-qqvj

WordPress Privilege Escalation Order Delivery Date For Woocommerce Wordpress Plugin Tychesoftwares

7.2

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.2 HIGH

Shop manager authentication required (PR:H); network-delivered exploit with no interaction; escalation stays within the same WordPress scope (S:U); full CIA impact upon successful privilege elevation.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 15:52 vuln.today

CVE Published

Aug 06, 2026 - 14:27 cve.org

HIGH 7.2

DescriptionCVE.org

Shop manager Privilege Escalation in Order Delivery Date for WooCommerce <= 4.6.0 versions.

AnalysisAI

Privilege escalation in Order Delivery Date for WooCommerce (versions ≤ 4.6.0) allows authenticated shop managers to exceed their intended role boundaries and gain elevated administrative access to the WordPress installation. Exploitation requires an existing shop manager account, confirmed by the CVSS:3.1 PR:H metric, limiting the attack surface to environments where untrusted or compromised accounts hold that role. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.

Technical ContextAI

The vulnerability resides in the Order Delivery Date for WooCommerce plugin developed by Tyche Softwares (CPE: cpe:2.3:a:tychesoftwares:order_delivery_date_for_woocommerce:*:*:*:*:*:*:*:*), a WordPress plugin that extends WooCommerce with delivery scheduling capabilities. The root cause is classified as CWE-266 (Incorrect Privilege Assignment), meaning the plugin fails to enforce proper WordPress capability checks when processing requests from shop manager-role users. In WordPress's role hierarchy, shop managers have broad access to orders, products, and store settings - but should be explicitly barred from administrative operations such as user management, plugin configuration, or site settings. The flaw likely involves a missing or incorrect capability check (e.g., using 'manage_woocommerce' instead of 'manage_options') in one or more AJAX handlers or admin endpoints exposed by the plugin, allowing role boundary crossing within the same WordPress application scope.

RemediationAI

The primary remediation is to update the Order Delivery Date for WooCommerce plugin beyond version 4.6.0 as soon as a patched release is published by Tyche Softwares; no specific fixed version is confirmed in the available data, so administrators should monitor the plugin's WordPress.org repository page and the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/order-delivery-date-for-woocommerce/vulnerability/wordpress-order-delivery-date-for-woocommerce-plugin-4-6-0-privilege-escalation-vulnerability for patch availability. As an immediate compensating control, audit and minimize the number of users assigned the shop manager role, restricting it only to fully trusted personnel, since the vulnerability requires an active shop manager account to exploit. If the plugin is not operationally essential, temporary deactivation eliminates the attack surface entirely with no trade-off beyond loss of delivery scheduling functionality. Organizations using a Web Application Firewall with WordPress rulesets (e.g., Wordfence, Patchstack's virtual patching) may receive a virtual patch that blocks the specific request pattern until an official fix is released.