CVE-2026-9613
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
The Datalogics Ecommerce Delivery – Datalogics plugin for WordPress in all versions up to and including 2.6.65 is vulnerable to authorization bypass. The plugin does not properly verify that a user is authorized to perform an action, allowing authenticated attackers with subscriber-level access and above to create and cancel real shipping orders via the external logistics API, modify arbitrary WooCommerce order post meta, overwrite the plugin's stored API token, and trigger shipping notification emails.
Risk Assessment
An authenticated low-privileged attacker can manipulate shipping orders, overwrite the API token, and send false notifications to customers. This may lead to financial losses, data leakage, and order fulfillment disruptions.
Recommendation
Update the Datalogics plugin to a version newer than 2.6.65 as soon as it becomes available. Until a fix is released, consider disabling the plugin or restricting user roles, and monitor for unusual order and API token operations.
Other vulnerabilities in Datalogics Ecommerce Delivery
Original NVD description (English source)
The Datalogics Ecommerce Delivery – Datalogics plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.65. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to create and cancel real shipping orders through the external logistics API using the store's stored authentication token, modify arbitrary WooCommerce order post meta on any order, overwrite the plugin's stored API token, and trigger shipping notification emails to customers.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS