Pre-Orders for WooCommerce <= 2.3.1 - Unauthenticated Improper Input Validation via Pre-Order Date
- ID
- WPSEC-2026-2911
- Plugin
- Pre-Orders for WooCommerce (pre-orders-for-woocommerce)
- Affected
- all versions before 2.3.2
- Remediation
- Update to 2.3.2 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-20
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-12
- Attack surface
- Pre-Orders for WooCommerce on WPSec AttackSurface
- Fix released
- Published
Description
The Pre-Orders for WooCommerce plugin for WordPress is vulnerable to Improper Input Validation via the pre-order date submitted at checkout in all versions up to, and including, 2.3.1, due to the classic checkout handler (managePreOrders) and, since 2.3, the block checkout Store API extension handler (save_pre_order_date_blocks) storing the customer-supplied date as the order's _preorder_date meta without validating its format, enforcing the product's availability date, or, on the Store API path, checking that the cart contains a pre-order product. This makes it possible for unauthenticated attackers to turn their own orders into pre-orders or set a pre-order date in the past, so that the order is moved to the pre-ordered status and automatically transitioned to completed before the merchant's availability date.
References
- https://wpsec.com/vuln/WPSEC-2026-2911/
- https://plugins.svn.wordpress.org/pre-orders-for-woocommerce/tags/2.3.2/
- https://wordpress.org/plugins/pre-orders-for-woocommerce/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS