# Pre-Orders for WooCommerce <= 2.3.1 - Unauthenticated Improper Input Validation via Pre-Order Date

- **ID:** WPSEC-2026-2911
- **Plugin:** Pre-Orders for WooCommerce (`pre-orders-for-woocommerce`), https://wordpress.org/plugins/pre-orders-for-woocommerce/
- **Affected versions:** all versions before 2.3.2
- **Fixed in:** 2.3.2 (Update to 2.3.2 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-20
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-12)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/pre-orders-for-woocommerce
- **Fix released:** 2026-11-10
- **Published:** 2026-11-12
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2911/

## Description

The Pre-Orders for WooCommerce plugin for WordPress is vulnerable to Improper Input Validation via the pre-order date submitted at checkout in all versions up to, and including, 2.3.1, due to the classic checkout handler (managePreOrders) and, since 2.3, the block checkout Store API extension handler (save_pre_order_date_blocks) storing the customer-supplied date as the order's _preorder_date meta without validating its format, enforcing the product's availability date, or, on the Store API path, checking that the cart contains a pre-order product. This makes it possible for unauthenticated attackers to turn their own orders into pre-orders or set a pre-order date in the past, so that the order is moved to the pre-ordered status and automatically transitioned to completed before the merchant's availability date.

## References

- https://wpsec.com/vuln/WPSEC-2026-2911/
- https://plugins.svn.wordpress.org/pre-orders-for-woocommerce/tags/2.3.2/
- https://wordpress.org/plugins/pre-orders-for-woocommerce/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2911/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.