This vulnerability in the Product Delivery Date for WooCommerce – Lite plugin arises from missing authorization checks, which leads to incorrect access control. This allows unauthorized users to perform actions that should be restricted, potentially altering data or configurations related to product delivery dates. The issue affects versions up to 3.2.0. The CVSS 3.1 base score is 5.3, reflecting a network attack vector with low attack complexity, no privileges required, and no user interaction needed. The impact is limited to integrity without affecting confidentiality or availability.

The vulnerability allows unauthorized modification of data or settings within the affected plugin, potentially leading to integrity issues. There is no evidence of confidentiality or availability impact. No known exploits have been reported in the wild, indicating limited or no active exploitation at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor vendor communications for updates. Applying principle of least privilege and restricting access to administrative interfaces may help reduce risk, but no specific mitigations are documented.