The vulnerability stems from a missing authorization check in the Product Delivery Date for WooCommerce – Lite plugin, enabling an attacker to exploit incorrectly configured access controls. As a result, unauthorized users can gain access to administrative functions that control product delivery dates, potentially altering or deleting schedules without proper permission. This flaw presents a direct compromise of data integrity for online store operations.

Implemented by tychesoftwares, the Product Delivery Date for WooCommerce – Lite plugin is affected from the earliest released version through 3.2.0. Sites running any of these vulnerable builds are at risk until the issue is remediated.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score of less than 1 % suggests that, as of the data available, exploitation likelihood is low. The vulnerability is not listed in the CISA KEV catalog, implying no widely documented exploits. The likely attack vector is through HTTP requests to the plugin’s administrative endpoints. Based on the description, it is inferred that the exploit does not require special privileges beyond standard site access, meaning that both authenticated and potentially unauthenticated users could leverage the flaw depending on site configuration.