{
 "id": "WPSEC-2026-2911",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2911/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2911/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2911/index.md",
 "title": "Pre-Orders for WooCommerce <= 2.3.1 - Unauthenticated Improper Input Validation via Pre-Order Date",
 "description": "The Pre-Orders for WooCommerce plugin for WordPress is vulnerable to Improper Input Validation via the pre-order date submitted at checkout in all versions up to, and including, 2.3.1, due to the classic checkout handler (managePreOrders) and, since 2.3, the block checkout Store API extension handler (save_pre_order_date_blocks) storing the customer-supplied date as the order's _preorder_date meta without validating its format, enforcing the product's availability date, or, on the Store API path, checking that the cart contains a pre-order product. This makes it possible for unauthenticated attackers to turn their own orders into pre-orders or set a pre-order date in the past, so that the order is moved to the pre-ordered status and automatically transitioned to completed before the merchant's availability date.",
 "plugin": {
  "slug": "pre-orders-for-woocommerce",
  "name": "Pre-Orders for WooCommerce",
  "full_name": "Pre-Orders for WooCommerce",
  "wordpress_org": "https://wordpress.org/plugins/pre-orders-for-woocommerce/",
  "advisories_url": "https://wpsec.com/vuln/plugin/pre-orders-for-woocommerce/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/pre-orders-for-woocommerce"
 },
 "type": "BYPASS",
 "cwe": [
  "CWE-20"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "2.3.2",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 2.3.2"
  ]
 },
 "introduced_in": null,
 "fixed_in": "2.3.2",
 "remediation": "Update to 2.3.2 or later.",
 "fix_released": "2026-11-10T17:14:53+00:00",
 "published": "2026-11-12T17:52:14+00:00",
 "updated": "2026-11-12T17:09:16.011660+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2911/",
  "https://plugins.svn.wordpress.org/pre-orders-for-woocommerce/tags/2.3.2/",
  "https://wordpress.org/plugins/pre-orders-for-woocommerce/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/pre-orders-for-woocommerce",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-12"
 }
}