{"id":"CVE-2026-110191","kind":"vulnerability","aliases":["CVE-2026-110191"],"related":[],"title":"WooCommerce Product Delivery Date plugin leaks other customers' order details","description":"The Product Delivery Date for WooCommerce  WordPress plugin before 3.3.2 does not perform a capability check before disclosing order details through its calendar view AJAX actions, allowing users with a role as low as Contributor to view other customers' order information.","summary":"The Product Delivery Date plugin for WooCommerce, before version 3.3.2, skips a capability check in its calendar view AJAX actions. A logged-in user with a low role such as Contributor can read other customers' order information.","severity":"low","cvss":2.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ecommerce","package","woocommerce","wordpress"],"not_affected_if":["no-untrusted-logged-in-users","plugin-at-3.3.2-or-later"],"how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or with `wp plugin get <plugin-slug> --field=version`\n- Confirm whether the site has users with the Contributor role or other low-privilege accounts that can log in","fix":"- Update the Product Delivery Date for WooCommerce plugin to `3.3.2` or later\n- Review who holds low-privilege accounts on the site until the update is applied","status":"open","published_at":"2026-10-16T07:17:10+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","triaged_at":"2026-10-25T04:48:08+00:00","updated_at":"2026-10-25T04:48:08+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-25T04:48:08Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Product Delivery Date for WooCommerce plugin to `3.3.2` or later\n- Review who holds low-privilege accounts on the site until the update is applied","reach":"internet","title":"WooCommerce Product Delivery Date plugin leaks other customers' order details","impact":"medium","summary":"The Product Delivery Date plugin for WooCommerce, before version 3.3.2, skips a capability check in its calendar view AJAX actions. A logged-in user with a low role such as Contributor can read other customers' order information.","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","ecommerce"],"confidence":0.8,"needs_auth":"yes","worst_case":"Logged-in low-privilege users read other customers' order details","analyst_note":"","how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or with `wp plugin get <plugin-slug> --field=version`\n- Confirm whether the site has users with the Contributor role or other low-privilege accounts that can log in","needs_analyst":false,"not_affected_if":["plugin-at-3.3.2-or-later","no-untrusted-logged-in-users"],"who_is_affected":"Sites running the Product Delivery Date for WooCommerce plugin before 3.3.2 that also let people with a logged-in account, such as Contributor, sign in. Sites without that plugin, or where every account is trusted staff with no low-privilege roles, have less exposure.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"low"},"cost_usd":0.000603,"input_tokens":3303,"output_tokens":546,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-110191':13A,16A '-2026':12A,15A '3.3.2':30B,68C 'action':40B,84C 'ajax':39B,83C 'allow':85C 'calendar':37B,81C 'capabl':33B,73C 'check':34B,74C 'contributor':52B,93C 'custom':8A,56B,97C 'cve':11A,14A 'date':4A,24B,62C 'deliveri':3A,23B,61C 'detail':10A,78C 'disclos':76C 'ecommerc':17B 'inform':58B,99C 'leak':6A 'log':43B 'logged-in':42B 'low':48B,91C 'order':9A,57B,77C,98C 'packag':18B 'perform':71C 'plugin':5A,25B,66C 'product':2A,22B,60C 'read':54B 'role':49B,89C 'skip':31B 'user':45B,86C 'version':29B 'view':38B,82C,95C 'woocommerc':1A,19B,27B,64C 'wordpress':20B,65C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Product Delivery Date for WooCommerce plugin before 3.3.2 that also let people with a logged-in account, such as Contributor, sign in. Sites without that plugin, or where every account is trusted staff with no low-privilege roles, have less exposure.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T07:17:10+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110191","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110191","severity":null,"published_at":"2026-10-16T07:17:10+00:00","modified_at":"2026-10-16T15:17:10+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}