How severe is CVE-2025-2942?

CVE-2025-2942 has a CVSS 3.x base score of 4.3, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is low, integrity none, and availability none.

Is CVE-2025-2942 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (17th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2025-2942?

CVE-2025-2942 affects Tychesoftwares Order Delivery Date For Woocommerce. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2025-2942?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2025-2942 have an EU (EUVD) identifier?

Yes. CVE-2025-2942 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-21114.

When was CVE-2025-2942 published?

CVE-2025-2942 was published on 2025-07-11 and last updated on 2026-06-17.

CVE-2025-2942

CVE-2025-2942 is a medium-severity vulnerability in Tychesoftwares Order Delivery Date For Woocommerce with a CVSS 3.x base score of 4.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.

Key facts

Severity: Medium (CVSS 3.x base score 4.3)
EPSS exploit prediction: 0% (17th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2025-21114
Affected product: Tychesoftwares Order Delivery Date For Woocommerce
Published: 2025-07-11
Last modified: 2026-06-17

Description

The Order Delivery Date WordPress plugin before 12.6.0 discloses arbitrary post title (such as from draft and private posts) via an unauthenticated AJAX action, allowing attackers to retrieve such information

Frequently asked questions

What is CVE-2025-2942?: The Order Delivery Date WordPress plugin before 12.6.0 discloses arbitrary post title (such as from draft and private posts) via an unauthenticated AJAX action, allowing attackers to retrieve such information
How severe is CVE-2025-2942?: CVE-2025-2942 has a CVSS 3.x base score of 4.3, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is low, integrity none, and availability none.
Is CVE-2025-2942 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (17th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2025-2942?: CVE-2025-2942 affects Tychesoftwares Order Delivery Date For Woocommerce. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2025-2942?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2025-2942 have an EU (EUVD) identifier?: Yes. CVE-2025-2942 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-21114.
When was CVE-2025-2942 published?: CVE-2025-2942 was published on 2025-07-11 and last updated on 2026-06-17.

References

https://wpscan.com/vulnerability/13a87567-2cf7-4bfb-8d63-a8e74950978f/

Affected products (1)

cpe:2.3:a:tychesoftwares:order_delivery_date_for_woocommerce:*:*:*:*:*:wordpress:*:*

More vulnerabilities in Tychesoftwares Order Delivery Date For Woocommerce

CVE-2025-2929 — High (CVSS 7.1): The Order Delivery Date WordPress plugin before 12.4.0 does not sanitise and escape a parameter before outputting it…
CVE-2023-41874 — High (CVSS 7.1): Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Tyche Softwares Order Delivery Date for WooCommerce…
CVE-2023-41858 — Medium (CVSS 4.3): Cross-Site Request Forgery (CSRF) vulnerability in Ashok Rane Order Delivery Date for WP e-Commerce plugin <= 1.2…

All CVEs affecting Tychesoftwares Order Delivery Date For Woocommerce →