CVE-2026-110191
CVE-2026-110191 · Product Delivery Date for WooCommerce – Lite < 3.3.2 - Contributor+ Order Information Disclosure via Calendar View AJAX Actions
This page contains facts from public vulnerability sources. Check the original advisory before updating.
The Product Delivery Date for WooCommerce WordPress plugin before 3.3.2 does not perform a capability check before disclosing order details through its calendar view AJAX actions, allowing users with a role as low as Contributor to view other customers' order information.
CVSS 2.7 · Low · EPSS 0.2% · Fix available
- Published
- Updated
Affected products and versions
product delivery date for woocommerce
- Versions
- ≥ 0, < 3.3.2: Affected (semver)
Update to 3.3.2