CVE-2026-65559 HIGH

CVE-2026-65559: WordPress Order Delivery Date for WooCommerce plugin <= 4.6.0 - Privilege Escalation vulnerability

Vendor Tychesoftwares
Product Order Delivery Date for WooCommerce
Weakness CWE-266
Published August 6, 2026
Last update August 6, 2026
View on NVD All CVEs

CVSS base score

7.2/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Shop manager Privilege Escalation in Order Delivery Date for WooCommerce <= 4.6.0 versions.

Explanation of Vulnerability in Simple Terms

02Summary

The Order Delivery Date for WooCommerce plugin through version 4.6.0 contains a privilege assignment flaw that allows high-privileged users to read, modify, or delete sensitive data and site functionality. The vulnerability requires administrator-level access and does not require user interaction. Site owners should update to a version newer than 4.6.0 to remediate the issue.

What an attacker can do

03Attacker Capabilities

A high-privileged user can read, modify, or delete sensitive data and disable site functionality.

Potential impact on your site

04Site Impact

Administrators with compromised credentials could cause data loss, site defacement, or service disruption.

Conditions required to exploit

05Prerequisites

Attacker must have administrator-level access to the WordPress site.

Key dates

06Disclosure timeline

August 6, 2026 CVE published
August 6, 2026 Record updated