Live › vulnerability › CVE-2026-110191
Go to dashboardThe Product Delivery Date plugin for WooCommerce, before version 3.3.2, skips a capability check in its calendar view AJAX actions. A logged-in user with a low role such as Contributor can read other customers' order information.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the Product Delivery Date for WooCommerce plugin before 3.3.2 that also let people with a logged-in account, such as Contributor, sign in. Sites without that plugin, or where every account is trusted staff with no low-privilege roles, have less exposure.
No product ranges from the sources yet.
wp plugin get <plugin-slug> --field=version3.3.2 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Product Delivery Date for WooCommerce WordPress plugin before 3.3.2 does not perform a capability check before disclosing order details through its calendar view AJAX actions, allowing users with a role as low as Contributor to view other customers' order information.
This page as .md · .json · in your agent: get_signal("CVE-2026-110191")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.