Byconsole Woo Order Delivery Time Vulnerabilities

The WooODT Lite – Delivery & pickup date time location for WooCommerce plugin for WordPress is vulnerable to payment bypass in all versions up to, and including, 2.5.5. This makes it possible for unauthenticated attackers to bypass payments for orders.

CVSS:

5.3

Affected:

up to 2.5.5

Fixed in:

2.5.6

Disclosed:

Feb 11, 2026

CVE-2025-69401 on NVD →

The WooODT Lite – Delivery & pickup date time location for WooCommerce plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.5.1. This is due the /inc/bycwooodt_get_all_orders.php file being publicly accessible and generating a publicly visible error message. This makes it p...

CVSS:

5.3

Affected:

up to 2.5.1

Fixed in:

2.5.2

Disclosed:

Feb 17, 2025

CVE-2024-13540 on NVD →

The WooODT Lite plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the byconsolewooodt_admin_fields_setting_files() function hooked via AJAX in versions up to, and including, 2.4.6. This makes it possible for authenticated attackers, with subscriber-level access...

CVSS:

8.8

Affected:

up to 2.4.6

Fixed in:

2.4.7

Disclosed:

Oct 31, 2023

CVE-2023-47179 on NVD →

The WooODT Lite plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 2.4.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully tri...

CVSS:

6.1

Affected:

up to 2.4.6

Fixed in:

2.4.7

Disclosed:

Oct 3, 2023

CVE-2023-45006 on NVD →