iscpcolissimo Colissimo Officiel Plugin up to 2.9.0 Shipping Method updateShippingMethod order_id improper authorization

Summaryinfo

A vulnerability was found in iscpcolissimo Colissimo Officiel Plugin up to 2.9.0. It has been rated as problematic. Impacted is the function updateShippingMethod of the component Shipping Method Handler. The manipulation of the argument order_id leads to improper authorization. This vulnerability is referenced as CVE-2026-9240. Remote exploitation of the attack is possible. No exploit is available.

Detailsinfo

A vulnerability was found in iscpcolissimo Colissimo Officiel Plugin up to 2.9.0 and classified as problematic. This issue affects the function updateShippingMethod of the component Shipping Method Handler. The manipulation of the argument order_id with an unknown input leads to a improper authorization vulnerability. Using CWE to declare the problem leads to CWE-285. The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. Impacted is integrity. The summary by CVE is:

The Colissimo Officiel : Méthodes de livraison pour WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the updateShippingMethod() function (registered to the wp_ajax_lpc_order_affect AJAX action) in versions up to, and including, 2.9.0. This is due to the handler performing no current_user_can() capability check and no nonce verification before reading an attacker-supplied order_id and modifying that order's shipping method, pickup-point meta, and shipping address. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create or modify the shipment information (shipping method, pickup relay data, and shipping address) of arbitrary WooCommerce orders, including orders placed by other users.

It is possible to read the advisory at wordfence.com. The identification of this vulnerability is CVE-2026-9240 since 05/21/2026. The exploitation is known to be easy. The attack may be initiated remotely. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 07/09/2026). The attack technique deployed by this issue is T1548.002 according to MITRE ATT&CK.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• iscpcolissimo

Name

• Colissimo Officiel Plugin

Version

• 2.0
• 2.1
• 2.2
• 2.3
• 2.4
• 2.5
• 2.6
• 2.7
• 2.8
• 2.9.0

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion