The vulnerability is an unauthenticated SQL injection in the Order Delivery Date for WooCommerce plugin for WordPress. It allows attackers to inject arbitrary SQL statements into the plugin’s queries, potentially leading to data exfiltration, data modification, or full compromise of the WordPress database. The weakness is identified as CWE‑89.

The affected product is the WordPress plugin Order Delivery Date for WooCommerce by tychesoftwares. Versions 4.5.1 and earlier are vulnerable. Any WordPress site running these plugin versions is at risk.

The CVSS score of 9.3 indicates a high severity flaw, while an EPSS score of less than 1% suggests a low current exploitation probability. The lack of an authentication requirement means a potential attacker could exploit the flaw from any web‑accessible location. The likely attack vector is through the plugin’s publicly accessible date handling endpoints; this inference is drawn from the absence of access controls and typical exposure of plugin hooks. The vulnerability is not yet listed in CISA’s KEV catalog, but its potential impact warrants immediate attention.