Missing Authorization vulnerability lets attackers bypass correctly configured access controls within the Order Delivery Date for WooCommerce plugin. An attacker who can submit requests as a logged‑in user may view or alter order delivery dates and other order settings, compromising order integrity and potentially causing incorrect shipping schedules. The weakness falls under CWE‑862, a missing authorization flaw.

The flaw affects any installation of the tychesoftwares Order Delivery Date for WooCommerce plugin through version 4.1.0, including older releases that were never updated. The vulnerability may be present in all environments where the plugin is active, regardless of the WordPress site domain.

The CVSS score of 4.3 classifies this as Medium severity, and an EPSS score of less than 1% suggests exploitation is unlikely in the wild, which is reinforced by its absence from KEV. The attack is likely carried out via the plugin's web interface or API endpoints, with the inference that it requires only that the user be authenticated but lacks sufficient privileges. An attacker could use this to change delivery dates or access restricted order data, causing business process disruption but not critical system compromise.