CVE-2026-9613 in Ecommerce Delivery Plugin
Summary
by MITRE • 09/19/2026
The Datalogics Ecommerce Delivery – Datalogics plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.65. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to create and cancel real shipping orders through the external logistics API using the store's stored authentication token, modify arbitrary WooCommerce order post meta on any order, overwrite the plugin's stored API token, and trigger shipping notification emails to customers.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/19/2026
The Datalogics Ecommerce Delivery plugin for WordPress contains a critical authorization bypass vulnerability affecting all versions up to 2.6.65. This flaw stems from insufficient verification of user privileges when handling administrative actions within the plugin's interface. Specifically, the software fails to enforce proper access controls on endpoints that manage shipping configurations and order modifications. As a result, any authenticated user with subscriber-level permissions or higher can execute functions intended exclusively for administrators or users with elevated roles. This misalignment between required capabilities and enforced checks allows lower-privileged accounts to perform high-risk operations without triggering appropriate authentication barriers.
The operational impact of this vulnerability is severe due to the plugin's integration with external logistics APIs using stored authentication tokens. An attacker leveraging this flaw can create and cancel real shipping orders, effectively manipulating fulfillment processes and potentially causing financial loss or logistical disruptions for the store owner. Furthermore, the ability to modify arbitrary WooCommerce order post meta data allows attackers to alter critical transaction details such as customer information, pricing, or tracking numbers. This capability undermines the integrity of e-commerce operations by enabling unauthorized changes to sensitive order attributes that are typically protected from lower-level users.
Beyond operational disruption, the vulnerability poses significant security risks regarding credential management and communication integrity. Attackers can overwrite the plugin's stored API token with malicious values, potentially granting them persistent access to external logistics services or facilitating further exploitation of connected systems. Additionally, the ability to trigger shipping notification emails enables phishing campaigns where attackers send fraudulent tracking information to customers, eroding trust in the brand. These actions collectively compromise confidentiality, integrity, and availability within the e-commerce ecosystem.
From a classification perspective, this issue aligns with CWE-269 Improper Privilege Control, as the application fails to enforce proper authorization checks for sensitive operations. The exploitation technique corresponds to ATT&CK T1078 Valid Accounts, where attackers leverage legitimate credentials to bypass security controls and perform unauthorized actions within the system environment. Remediation requires immediate updating of the Datalogics Ecommerce Delivery plugin to version 2.6.66 or later, which addresses these authorization gaps by implementing strict role-based access control checks on all affected endpoints. Administrators should also audit recent order modifications and API token usage for signs of exploitation before applying patches.