CVE-2026-110191 in Product Delivery Date Plugin
Summary
by MITRE • 10/16/2026
The Product Delivery Date for WooCommerce WordPress plugin before 3.3.2 does not perform a capability check before disclosing order details through its calendar view AJAX actions, allowing users with a role as low as Contributor to view other customers' order information.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/16/2026
The vulnerability identified in the Product Delivery Date extension for WooCommerce prior to version 3.3.2 represents a critical failure in access control mechanisms within the WordPress ecosystem. This flaw specifically affects the AJAX actions responsible for rendering calendar views that display product delivery schedules and associated order details. The core technical deficiency lies in the absence of proper capability verification before processing requests that expose sensitive customer data. In secure software architecture, any endpoint or function that retrieves private user information must strictly validate that the requesting entity possesses the necessary permissions to access such data. However, this implementation fails to enforce these checks at the point where order details are disclosed through the calendar interface, creating a significant security gap.
From an operational perspective, this vulnerability allows attackers with minimal privileges within the WordPress environment to exploit the system for unauthorized information disclosure. Specifically, users assigned the Contributor role, which is typically intended for content creation and has very limited administrative capabilities, can bypass standard restrictions. By crafting specific AJAX requests targeting the vulnerable calendar view endpoints, these low-privileged users can retrieve order details belonging to other customers. This includes potentially sensitive personal information such as names, addresses, purchase histories, and payment statuses. The ability of a Contributor-level user to access this data undermines the fundamental principle of least privilege that underpins secure multi-user systems like WordPress installations used by e-commerce businesses.
The impact of this vulnerability extends beyond simple privacy violations for individual customers. For business owners operating WooCommerce stores, it poses a severe risk to customer trust and regulatory compliance. The exposure of order details can lead to reputational damage, potential legal liabilities under data protection regulations such as GDPR or CCPA, and financial loss due to fraud or identity theft facilitated by the leaked information. Furthermore, because WordPress plugins often share codebases or rely on similar architectural patterns, this type of vulnerability highlights broader risks in plugin development where AJAX endpoints are frequently implemented without rigorous security auditing. The lack of capability checks serves as a common attack vector that can be automated and exploited at scale against vulnerable installations.
To mitigate this risk, immediate action is required to update the Product Delivery Date extension to version 3.3.2 or later, which addresses these access control deficiencies by implementing proper permission verification for all AJAX actions involving sensitive data. Administrators should also ensure that their WordPress environments are hardened by restricting user roles wherever possible and monitoring logs for unusual activity patterns indicative of exploitation attempts. Additionally, developers integrating similar functionality in custom plugins must adhere to industry standards such as CWE-285 Improper Authorization when designing access control logic. It is essential to validate capabilities using functions like current_user_can or equivalent security checks before any data retrieval operations are executed. Regular security audits and adherence to the MITRE ATT&CK framework, particularly regarding techniques related to Collection via Local Data Scraping or Unauthorized Access to Resources, can help prevent similar vulnerabilities in future development cycles.