This vulnerability (CVE-2026-65559) in the Order Delivery Date for WooCommerce plugin (versions <= 4.6.0) is classified as CWE-266 (Incorrect Privilege Assignment). It allows users with shop manager roles to escalate their privileges beyond intended limits, potentially leading to full administrative control or unauthorized actions within the WooCommerce environment. The CVSS 3.1 score of 7.2 reflects network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. There is no vendor advisory or patch available at this time, and no known exploits in the wild have been reported.

Successful exploitation of this vulnerability could allow a shop manager to gain elevated privileges, potentially compromising the confidentiality, integrity, and availability of the WooCommerce store. This could lead to unauthorized access to sensitive data, modification of orders or settings, and disruption of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict shop manager privileges where possible and monitor for suspicious activity related to privilege escalation attempts.