Order Delivery Date WordPress Plugin Missing Authorization Vulnerability Allowing Unauthenticated Option Updates

A vulnerability exists in the Order Delivery Date WordPress plugin, specifically in versions prior to 12.3.1. The issue arises because the plugin lacks proper authorization and Cross-Site Request Forgery (CSRF) protections when importing settings. Additionally, it fails to restrict option updates to those relevant to the plugin. As a result, attackers can manipulate certain user role settings, such as changing the default user role to administrator and enabling user registration as an administrator, potentially leading to a complete takeover of the site.

Impact

Exploitation of this vulnerability allows for unauthorized users to gain administrative access to the WordPress site, effectively taking over the site.

Remediation

Users are advised to update the Order Delivery Date WordPress plugin to version 12.3.1 or later.