CVE-2025-63024: 
WordPress vulnerability analysis and mitigation

CVE-2025-63024 is a Missing Authorization vulnerability in the Order Delivery Date for WooCommerce WordPress plugin developed by Tyche Softwares. It allows unauthenticated network-based attackers (with required user interaction) to exploit incorrectly configured access control security levels, resulting in limited integrity and availability impacts. The vulnerability affects all plugin versions up to and including 4.3.1. It was published on December 9, 2025, and assigned by Patchstack. The CVSS v3.1 base score is 5.4 (Medium) (Feedly, ENISA EUVD).

The root cause is classified as CWE-862 (Missing Authorization) — the plugin fails to properly verify whether a requesting user has the appropriate permissions before executing certain actions, effectively allowing exploitation of incorrectly configured access control levels. The attack vector is network-based with low attack complexity, requires no privileges, but does require user interaction (e.g., a victim visiting a crafted page or clicking a malicious link). This class of vulnerability in WordPress plugins typically manifests as unprotected AJAX endpoints or admin-action hooks that lack current_user_can() or nonce checks, enabling unauthorized state changes (Feedly, Patchstack).

Successful exploitation results in limited but tangible impacts: low integrity impact (unauthorized modification of data, such as order delivery date settings) and low availability impact (potential disruption of delivery scheduling functionality), with no confidentiality impact. The scope is unchanged, meaning the vulnerability does not allow attackers to pivot beyond the affected component. While not critical, manipulation of order delivery dates on an e-commerce platform could disrupt business operations or customer experience (Feedly).

No public proof-of-concept exploit code or active in-the-wild exploitation has been reported for CVE-2025-63024 as of the available data. The EPSS score is approximately 0.017%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified (Feedly).

Users should update the Order Delivery Date for WooCommerce plugin to a version beyond 4.3.1 that addresses this missing authorization issue. Check the WordPress plugin repository or the Tyche Softwares website for the latest patched release. As a general workaround, site administrators can temporarily deactivate the plugin until a patch is applied, and should audit WordPress user roles and capabilities to limit exposure. Monitoring plugin update channels and applying updates promptly is the recommended long-term remediation (Patchstack, Feedly).