CVE-2023-52210: 
WordPress vulnerability analysis and mitigation

CVE-2023-52210 is a Broken Access Control vulnerability in the Product Delivery Date for WooCommerce – Lite WordPress plugin by Tyche Softwares. It affects all versions up to and including 2.7.0, and was reported by researcher Mika on December 10, 2023, with public disclosure by Patchstack on January 3, 2024. The CVE was formally published in the NVD on December 23, 2025. It carries a CVSS v3.1 base score of 5.3 (Medium), assigned by Patchstack (Patchstack).

The vulnerability is classified as CWE-287 (Improper Authentication) and represents a broken access control issue — specifically, a missing authorization, authentication, or nonce token check in a plugin function (Patchstack). This flaw allows unauthenticated remote attackers to invoke functionality that should be restricted to privileged users, requiring no user interaction and no special configuration. The attack vector is network-accessible, with low complexity, making it straightforward to exploit at scale. No public proof-of-concept code has been identified at this time.

Successful exploitation results in a limited availability impact (CVSS A:L), with no confidentiality or integrity impact according to the assigned vector. An unauthenticated attacker could trigger restricted plugin actions — such as manipulating delivery date settings or related WooCommerce order data — potentially disrupting store operations. The scope is limited to the affected WordPress installation and does not directly enable lateral movement or sensitive data exfiltration (Patchstack).

The vulnerability is patched in version 2.7.1 of the Product Delivery Date for WooCommerce – Lite plugin. Site administrators should update to version 2.7.1 or later immediately via the WordPress plugin dashboard. If an immediate update is not possible, consult your hosting provider or web developer for assistance. Patchstack users can enable auto-update for vulnerable plugins as an additional safeguard (Patchstack).

Wordfence included this vulnerability in its weekly WordPress vulnerability report for the period of January 1–7, 2024, providing broader community visibility. No significant vendor statements beyond Patchstack's disclosure or notable researcher commentary have been identified for this CVE.