CVE-2026-110191: WooCommerce Plugin Information Disclosure

CVE-2026-110191 Overview

CVE-2026-110191 is an information disclosure vulnerability in the Product Delivery Date for WooCommerce WordPress plugin. Versions prior to 3.3.2 fail to perform a capability check in the calendar view AJAX actions. Any authenticated user with a role as low as Contributor can retrieve order details belonging to other customers. The flaw is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
Low-privileged WordPress users can enumerate customer order information through unauthenticated AJAX endpoints exposed by the plugin's calendar view.

Affected Products

Product Delivery Date for WooCommerce WordPress plugin versions before 3.3.2
WordPress installations running the vulnerable plugin with Contributor-level or higher user accounts
WooCommerce stores exposing calendar view AJAX actions to authenticated users

Discovery Timeline

2026-10-16 - CVE-2026-110191 published to NVD
2026-10-16 - Last updated in NVD database

Technical Details for CVE-2026-110191

Vulnerability Analysis

The Product Delivery Date for WooCommerce plugin exposes AJAX actions that render a calendar view of scheduled deliveries. These actions return order metadata including customer names, delivery dates, and order identifiers. The plugin registers the AJAX handlers for authenticated WordPress users but omits a role or capability check before returning data. As a result, any logged-in user who can access admin-ajax.php can retrieve order details that should be restricted to shop managers and administrators.

Contributor is a built-in WordPress role designed for users who draft posts without publishing privileges. Granting Contributor-level accounts read access to customer order data breaks the WooCommerce authorization model. The disclosed information can include personally identifiable information (PII) tied to purchases.

Root Cause

The root cause is a missing authorization check in the calendar view AJAX actions. The handlers verify that a request is authenticated but do not call current_user_can() against a WooCommerce-appropriate capability such as manage_woocommerce or view_woocommerce_reports. The plugin treats authentication as sufficient authorization, which maps directly to [CWE-200].

Attack Vector

An attacker first obtains a Contributor-level account on the target WordPress site, either through self-registration, social engineering, or credential compromise. The attacker then sends crafted POST requests to wp-admin/admin-ajax.php invoking the plugin's calendar view actions. The server returns order details in the AJAX response without validating the caller's role. The attack requires no user interaction and leaves standard WordPress access logs showing only ordinary AJAX traffic. Technical details are documented in the WPScan Vulnerability Report.

Detection Methods for CVE-2026-110191

Indicators of Compromise

POST requests to wp-admin/admin-ajax.php originating from accounts with Contributor or Subscriber roles that reference the plugin's calendar view actions
Unusual volumes of AJAX responses containing WooCommerce order identifiers served to non-administrative sessions
Enumeration patterns where a single authenticated session repeatedly queries sequential delivery dates

Detection Strategies

Review web server access logs for admin-ajax.php requests tied to the Product Delivery Date plugin action names and correlate the requesting user ID against assigned WordPress roles
Enable WordPress audit logging to capture AJAX action invocations and flag calendar view calls initiated by low-privileged accounts
Inspect database query logs for order lookups originating from PHP sessions that lack manage_woocommerce capability

Monitoring Recommendations

Monitor creation of new Contributor and Subscriber accounts, particularly on sites that allow open registration
Alert on AJAX responses containing order metadata returned to sessions outside the shop manager and administrator roles
Track installed plugin versions across WordPress fleet inventories and flag any instance of Product Delivery Date for WooCommerce below version 3.3.2

How to Mitigate CVE-2026-110191

Immediate Actions Required

Upgrade Product Delivery Date for WooCommerce to version 3.3.2 or later on all WordPress installations
Audit existing WordPress accounts and remove unnecessary Contributor, Author, or Subscriber accounts that were not provisioned by the business
Disable open user registration on WooCommerce sites unless it is required for store operations

Patch Information

The plugin vendor addressed the issue in version 3.3.2 by adding capability checks to the calendar view AJAX actions. Administrators should update through the WordPress plugin dashboard or by replacing the plugin directory with the patched release. Confirm the active version in the WordPress admin after the update completes.

Workarounds

Temporarily deactivate the Product Delivery Date for WooCommerce plugin until the patch is applied
Restrict access to wp-admin/admin-ajax.php for low-privileged roles using a web application firewall (WAF) rule that filters the vulnerable action names
Set users_can_register to false in WordPress general settings to prevent anonymous creation of Contributor accounts

bash

# Verify the installed plugin version via WP-CLI and update if vulnerable
wp plugin get woocommerce-delivery-date --field=version
wp plugin update woocommerce-delivery-date --version=3.3.2
wp option update users_can_register 0