CVE-2025-2907
CVSS 3.1 Score 9.8 of 10 (high)
Details
Published Apr 26, 2025
Updated: May 14, 2025
CWE ID 352
Summary
CVE-2025-2907 is a vulnerability affecting the Order Delivery Date plugin for WordPress before version 12.3.1. The issue lies in the lack of authorization and Cross-Site Request Forgery (CSRF) checks during the settings import process. Attackers can exploit this vulnerability to modify critical options, including default_user_role and users_can_register, allowing unauthorized users to register as administrators and gain complete site takeover.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.