The vulnerability CVE-2024-55997 affects the webchunky 'Order Delivery & Pickup Location Date Time' plugin versions up to 1.1.0. It is caused by missing authorization checks, allowing attackers to bypass access controls. This can lead to unauthorized modification or disruption of order delivery and pickup location date/time settings. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, low integrity impact, and low availability impact.

Exploitation of this vulnerability could allow an unauthenticated attacker to perform unauthorized actions related to order delivery and pickup scheduling, potentially modifying or disrupting these settings. There is no confidentiality impact, but integrity and availability impacts are rated low. No evidence of active exploitation in the wild is currently known.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix is currently referenced, users should monitor the vendor's communications for updates. Until a fix is available, restrict access to the affected plugin functionality where possible and consider disabling the plugin if it is not essential.