CVE-2025-2942: 
WordPress vulnerability analysis and mitigation

CVE-2025-2942 is an unauthenticated arbitrary post title disclosure vulnerability in the Order Delivery Date Pro for WooCommerce WordPress plugin. It affects all versions before 12.6.0 and allows unauthenticated attackers to retrieve post titles from draft and private posts via an exposed AJAX action. The vulnerability was publicly disclosed on June 20, 2025, and assigned a CVSS v3.1 base score of 4.3 (Medium) (WPScan, Red Hat).

The vulnerability is classified as CWE-200 (Information Exposure / Sensitive Data Exposure) and stems from an unprotected AJAX action (orddd_order_calendar_content) that does not enforce authentication or authorization checks before returning post title data. An unauthenticated attacker can send a crafted HTTP GET request to wp-admin/admin-ajax.php with specific parameters to trigger the disclosure. The AJAX endpoint accepts parameters including order_id, event_value, event_type, and event_product_id, and returns post titles without verifying the requester's identity or permissions (WPScan).

Successful exploitation allows any unauthenticated attacker to enumerate and retrieve titles of arbitrary WordPress posts, including those in draft or private status that are not intended to be publicly visible. This constitutes a confidentiality breach that could expose sensitive business information, unreleased content, or internal communications stored as draft/private posts. There is no impact on integrity or availability, and the scope is limited to the affected WordPress installation (WPScan, Red Hat).

A proof-of-concept exploit is publicly available on WPScan, demonstrating exploitation via a simple unauthenticated HTTP GET request — no special tools or credentials are required. There is no evidence of active in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.018% (0.000180), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (WPScan).

1. Reconnaissance: Identify WordPress sites running the Order Delivery Date Pro for WooCommerce plugin in a version prior to 12.6.0 using tools like WPScan, Shodan, or manual inspection of plugin directories.
2. Craft the request: Construct an unauthenticated HTTP GET request targeting the vulnerable AJAX endpoint with the following URL structure: http://example.com/wp-admin/admin-ajax.php?action=orddd_order_calendar_content&order_id=&event_value=a&event_type=order&event_product_id=
3. Enumerate post IDs: Iterate over possible order_id or event_product_id values to enumerate post titles across different posts, including drafts and private posts.
4. Collect disclosed data: Parse the server response to extract post titles, which may reveal sensitive or unpublished content not intended for public access (WPScan).

• Network: Repeated unauthenticated HTTP GET requests to /wp-admin/admin-ajax.php with the parameter action=orddd_order_calendar_content from a single or rotating IP address.
• Logs: Web server access logs showing sequential or automated requests to the AJAX endpoint with varying order_id or event_product_id values, particularly from non-authenticated sessions.
• Logs: WordPress debug or access logs showing high-frequency calls to the orddd_order_calendar_content AJAX action without corresponding authenticated user sessions.

The vendor (Tyche Softwares) has released version 12.6.0 of the Order Delivery Date Pro for WooCommerce plugin, which fixes this vulnerability by adding proper authentication checks to the affected AJAX action. Site administrators should update the plugin to version 12.6.0 or later immediately. As an interim measure, administrators can restrict access to wp-admin/admin-ajax.php for unauthenticated users via web server rules or a WAF, and audit recent access logs for signs of unauthorized enumeration (WPScan).

The vulnerability was discovered and reported by Erwan LR of WPScan, who also provided the proof-of-concept. Wordfence included it in their weekly WordPress vulnerability report for the week of June 16–22, 2025, contributing to broader community awareness (Wordfence Blog). No significant additional vendor statements or notable social media reactions have been identified beyond standard vulnerability database listings.