CVE-2026-2631: Datalogics Ecommerce Delivery < 2.6.60 - Unauthenticated Privilege Escalation
The Datalogics Ecommerce Delivery WordPress plugin before 2.6.60 exposes an unauthenticated REST endpoint that allows any remote user to modify the option datalogicstoken without verification. This token is subsequently used for authentication in a protected endpoint that allows users to perform arbitrary WordPress updateoption() operations. Attackers can use this to enable registartion and to set the default role as Administrator.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-2631?
CVE-2026-2631 has been rated as a critical vulnerability due to its potential for unauthenticated privilege escalation.
How do I fix CVE-2026-2631?
To fix CVE-2026-2631, upgrade the Datalogics Ecommerce Delivery plugin to version 2.6.60 or later.
What impact does CVE-2026-2631 have on my website?
CVE-2026-2631 allows remote users to modify sensitive options, potentially compromising the security and functionality of your website.
Who is affected by CVE-2026-2631?
Websites using Datalogics Ecommerce Delivery plugin versions prior to 2.6.60 are affected by CVE-2026-2631.
Is authentication required to exploit CVE-2026-2631?
No, CVE-2026-2631 can be exploited without authentication, making it particularly dangerous.