Product Delivery Date EUVD-2026-102698

Requires an authenticated WordPress account with at least the Contributor role on a site running Product Delivery Date for WooCommerce below 3.3.2; the attacker then calls the plugin's calendar-view AJAX action, which lacks a capability check. This is NOT unauthenticated - the key limiting factor is that the attacker must already possess a valid low-privilege account on the target site, so exposure is confined to stores that provision Contributor-or-higher accounts to untrusted or semi-trusted users. No special plugin configuration beyond having the calendar view in use is indicated, and no user interaction is required.

This is a low-severity information-disclosure issue that should be treated as low priority despite multiple corroborating sources. The signals are largely consistent on the low end: CVSS base score is 2.7, EPSS is 0.15% (4th percentile) indicating very low probability of broad exploitation, and it is NOT on CISA KEV. A public exploit exists (WPScan), but POC availability is distinct from active exploitation and does not by itself elevate priority here. Note a discrepancy between the supplied CVSS vector and the description: the vector encodes PR:H (high privileges), yet the description states exploitation requires only a role 'as low as Contributor,' which is a LOW-privilege authenticated role - this points to PR:L rather than PR:H and suggests the official vector slightly overstates the privilege barrier (making the flaw marginally easier to exploit than the vector implies). The impact is confidentiality-only and partial (C:L, I:N, A:N): an attacker learns other customers' order details, with no integrity or availability effect. Realistically this matters only on multi-author/multi-role WooCommerce sites that grant Contributor+ accounts to semi-trusted users; single-admin stores have no exposure. Patch to 3.3.2 is the clear remediation.

On a WooCommerce store running the plugin below 3.3.2, a user holding a Contributor-level account (e.g., a guest blogger or low-trust staff member) invokes the plugin's calendar-view AJAX action, which fails to verify capabilities and returns other customers' order information. A public exploit/PoC is documented by WPScan, and because the action is reachable over the network (AV:N) with low complexity (AC:L) and no user interaction, a logged-in low-privilege attacker can harvest order data directly.