CVE Daily

CVE-2025-2942

The Order Delivery Date WordPress plugin before 12.6.0 discloses arbitrary post ...

Medium CVSS 4.3

Overview

The Order Delivery Date WordPress plugin before 12.6.0 discloses arbitrary post title (such as from draft and private posts) via an unauthenticated AJAX action, allowing attackers to retrieve such information

CWE: N/A Published: 2025-07-11T06:15:22.977
Risk analysis

This vulnerability is rated 🟡 MEDIUM.

  • CVSS: 4.3 (MEDIUM)
  • Detected tags: wordpress (tag impact: LOW)

Recommended actions:

  • Prioritize remediation based on business criticality and exposure.
  • Limit exposure and increase monitoring until fixed.

Recommended tools

Tags