CVE-2025-2907: Unauthenticated Arbitrary Options Update in Order Delivery Date for WooCommerce

Introduction

CVE-2025-2907 is a critical vulnerability affecting the Order Delivery Date for WooCommerce WordPress plugin. The vulnerability allows an unauthenticated attacker to modify arbitrary WordPress options through the plugin's settings-import functionality.

The issue affects Order Delivery Date for WooCommerce versions 2.0 through versions earlier than 12.3.1 and allows attackers to modify security-sensitive WordPress options. The vulnerability received a CVSS v3.1 score of 9.8 (Critical).

The vulnerability specifically affects the Pro version of the plugin. The issue can potentially be abused to modify default_user_role and users_can_register, allowing an attacker to register an administrator account and potentially take complete control of the WordPress installation.

A public research repository is also available from Yucaerin/CVE-2025-2907, containing a Python-based PoC and technical information about the vulnerability.

Vulnerability Overview

The vulnerability exists in the settings import functionality of the Order Delivery Date for WooCommerce plugin.

The core security problem is that the affected import functionality does not properly enforce authorization and CSRF protections. It also does not sufficiently restrict which WordPress options can be modified through the import mechanism.

In simplified terms, the security problem looks like this:

Unauthenticated Request
        │
        ▼
Settings Import Function
        │
        ▼
Imported Configuration
        │
        ▼
Insufficient Authorization
        │
        ▼
Arbitrary WordPress Options
        │
        ▼
Registration Settings Modified
        │
        ▼
Administrator Account
        │
        ▼
Potential Site Takeover

The important point is that a settings-import mechanism must verify that the requester is authorized to modify application configuration.

It should also restrict imported values to the options that actually belong to the plugin rather than allowing arbitrary WordPress options to be modified.

Why Is This Vulnerability Serious?

Configuration-manipulation vulnerabilities are particularly dangerous when they affect authentication or user-registration settings.

In this case, an unauthenticated attacker can potentially modify WordPress options that control whether users can register and what role newly registered users receive.

By setting the default registration role to administrator and enabling registration, an attacker may be able to obtain administrator-level access to the WordPress installation.

The potential consequences include:

• Unauthorized modification of WordPress configuration
• Unauthorized administrator account creation
• Privilege escalation
• Access to the WordPress dashboard
• Modification of website content and settings
• Further compromise of the affected website

The CVSS vector is:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

This indicates a remotely reachable vulnerability with low attack complexity that requires neither authentication nor user interaction and can potentially have high impact on confidentiality, integrity, and availability.

Root Cause

The underlying issue is missing authorization and CSRF protection in the settings-import functionality, combined with insufficient validation of which WordPress options can be modified.

A secure settings-import implementation should independently verify:

• The identity of the requester
• Whether the requester has permission to modify the settings
• That the request contains a valid CSRF token
• That imported options belong to the intended plugin
• That sensitive WordPress options cannot be modified through the import mechanism
• That imported values have the expected format and type

A secure flow should conceptually look like this:

Settings Import Request
        │
        ▼
Verify Authorization
        │
        ├── Not Authorized → Reject
        │
        ▼
Verify CSRF Token
        │
        ├── Invalid → Reject
        │
        ▼
Validate Imported Options
        │
        ├── Unauthorized Option → Reject
        │
        ▼
Apply Plugin Settings

By contrast, an implementation that accepts arbitrary configuration data without properly checking authorization can allow attackers to modify security-sensitive WordPress options.

CVE-2025-2907 demonstrates why configuration-import functionality must be treated as a privileged operation.

Affected Versions

The vulnerable versions are:

These details are documented by NVD and Wordfence.

The vulnerability was publicly disclosed in April 2025, and version 12.3.1 is identified as the patched version.

Public PoC

The associated GitHub repository contains a Python-based research script for CVE-2025-2907.

The repository documents the vulnerability as an unauthenticated arbitrary-options-update issue affecting the Order Delivery Date plugin and provides technical material related to the vulnerability.

For defensive research, proof-of-concept material should only be used in an authorized laboratory environment or against systems where explicit permission has been granted.

Security Impact

The impact of this vulnerability is potentially severe because it allows unauthorized modification of WordPress configuration.

A vulnerable installation could potentially face:

1. Unauthorized Option Modification

An attacker may be able to modify WordPress options without authenticating.

2. Administrator Account Creation

The vulnerable functionality can potentially be abused to change the default registration role to administrator and enable user registration.

3. Privilege Escalation

An unauthenticated attacker could potentially move from having no privileges to obtaining an administrator-level account.

4. Website Takeover

Administrator access could allow unauthorized modification of website content, settings, users, themes, and plugins.

5. Further Compromise

Once administrative access has been obtained, the attacker could potentially use that access to perform additional malicious modifications to the WordPress installation.

The seriousness of the issue is reflected by its 9.8 Critical CVSS score.

Detection and Mitigation

Administrators should first determine whether the Order Delivery Date for WooCommerce Pro plugin is installed and identify its current version.

The primary mitigation is to update the plugin to 12.3.1 or a newer patched release.

Recommended defensive actions include:

• Update Order Delivery Date for WooCommerce Pro to the latest available version.
• Remove the plugin if it is no longer required.
• Review WordPress administrator accounts for unexpected additions.
• Check whether user registration was unexpectedly enabled.
• Check whether the default user role was unexpectedly changed.
• Review access logs for suspicious settings-import requests.
• Review recent changes to WordPress configuration.
• Monitor for unexpected changes to themes and plugins.
• Use a Web Application Firewall where appropriate.
• Keep WordPress core, plugins, and themes up to date.

Because the vulnerability can potentially result in administrator account creation, reviewing the WordPress Users section should be an important part of incident response.

Indicators of Compromise

For incident-response purposes, administrators should review web-server and WordPress logs for suspicious activity associated with the plugin's settings-import functionality.

A proper investigation should also examine:

Web Server Logs
      │
      ├── Suspicious Settings Import Requests
      │
      ├── Unexpected User Registrations
      │
      ├── New Administrator Accounts
      │
      ├── Registration Setting Changes
      │
      └── Recent WordPress Configuration Changes

Particular attention should be given to administrator accounts created unexpectedly around the time suspicious requests were observed.

Log activity alone should not be treated as definitive proof of compromise. Account, configuration, filesystem, and authentication logs should be correlated during an investigation.

Conclusion

CVE-2025-2907 is a critical WordPress plugin vulnerability that demonstrates the dangers of insufficient authorization in configuration-import functionality.

The issue affects Order Delivery Date for WooCommerce versions from 2.0 through versions earlier than 12.3.1 and allows unauthenticated attackers to modify arbitrary WordPress options.

These changes can potentially enable user registration and change the default registration role to administrator, ultimately allowing complete website takeover.

With a CVSS v3.1 score of 9.8, no authentication requirement, and a potential path from unauthorized configuration changes to administrator access, affected installations should be treated as a high-priority security concern.

The vulnerability was patched in version 12.3.1, and administrators should upgrade to a current patched release as soon as possible.

For security researchers, CVE-2025-2907 provides a useful case study for understanding missing authorization, CSRF protection, arbitrary WordPress option modification, user-registration security, privilege escalation, and secure configuration-import design.

SOURCE: CVE-2025-2907 — Yucaerin GitHub Repository

References: NVD — CVE-2025-2907 · Wordfence — CVE-2025-2907