All vulnerabilities
CVE-2026-110191

Product Delivery Date for WooCommerce – Lite < 3.3.2 - Contributor+ Order Information Disclosure via Calendar View AJAX Actions

Unknown Product Delivery Date for WooCommerce
Open in ThreatlineRecord JSON
CVSS
2.7Low
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.23%Chance of exploitation activity in the next 30 days, higher than 13% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in3.3.2Fixed versionCVE List
Published16 Oct 2026Updated 16 Oct 2026CVE List

What fixes it

  • 3.3.2Product Delivery Date for WooCommerceCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

The Product Delivery Date for WooCommerce WordPress plugin before 3.3.2 does not perform a capability check before disclosing order details through its calendar view AJAX actions, allowing users with a role as low as Contributor to view other customers' order information.

Text from CVE List

Affected versions 1

  • Product Delivery Date for WooCommerceaffected: all versions before 3.3.2CVE List

References 1