CVE-2026-9613: Datalogics Ecommerce Delivery <= 2.6.65 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via Multiple AJAX Actions (datalogics_create_shipping / datalogics_cancel_shipping)
The Datalogics Ecommerce Delivery – Datalogics plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.65. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to create and cancel real shipping orders through the external logistics API using the store's stored authentication token, modify arbitrary WooCommerce order post meta on any order, overwrite the plugin's stored API token, and trigger shipping notification emails to customers.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Datalogics Ecommerce Delivery (Datalogics plugin for WordPress)to a version that resolves this vulnerability.Fixed in 2.6.65 - Compensating control
Restrict access so that only authorized roles (beyond Subscriber+) can invoke shipping-related AJAX actions that call the external logistics API (e.g., datalogics_create_shipping and datalogics_cancel_shipping).
- Operational
After patching, rotate/replace the plugin's stored external logistics API token because the vulnerability can allow an attacker to overwrite it using the store’s stored authentication token.
- Operational
Review and remediate any shipping orders created/canceled and any WooCommerce order post meta that may have been modified on other orders while the vulnerability was exploitable.
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated WordPress user with Subscriber-level access or higher can exploit it. The attacker does not need administrator or WooCommerce management permissions.
What access or conditions does an attacker need?
The attacker needs a valid account on the affected WordPress site. Exploitation is performed through the plugin's AJAX actions and does not require user interaction.
What could an attacker change or trigger?
An attacker can create or cancel real shipping orders through the external logistics API, alter WooCommerce order post meta for any order, replace the plugin's stored API token, and send shipping notification emails to customers.
Are installations using version 2.6.65 affected?
Yes. The issue affects all plugin versions up to and including 2.6.65.