EUVD-2026-36966
GHSA-x49r-2376-h28q
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessScan WordPress sites for plugin fingerprint
-
DeliveryIdentify vulnerable Datalogics endpoint
-
ExploitSend unauthenticated privilege-escalation request
-
ExecutionObtain administrator role
-
PersistUpload malicious plugin/webshell
-
ImpactEstablish persistence and exfiltrate data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Privilege assignment review
|
| Exploitation Conditions | Target site must have the Datalogics Ecommerce Delivery WordPress plugin installed and activated at version 2.6.62 or earlier, and the WordPress AJAX/REST endpoint exposing the vulnerable privileged action must be reachable from the attacker's network position (the default for any public WordPress storefront). No authentication, no user interaction, and no special configuration toggle is required per the CVSS PR:N/UI:N vector. Limiting factors: the plugin must actually be installed (it is a third-party plugin, not WordPress core), and a WAF or IP allowlist in front of /wp-admin/admin-ajax.php or the plugin's REST routes would block the exploit path. |
| Impact | All risk signals point to high real-world exposure: CVSS 9.8 with AV:N/AC:L/PR:N/UI:N means the attack is reachable from the internet over normal HTTP(S), requires no authentication, no user interaction, and trivial complexity, with high impact across confidentiality, integrity, and availability. Patchstack - a credible WordPress vulnerability database - is the source, but no EPSS score, KEV listing, or public POC has been published in the data provided, so risk is currently 'high latent' rather than 'confirmed mass-exploited.' Given the WordPress plugin ecosystem's history (privilege-escalation flaws in widely-deployed plugins are routinely turned into mass-scanning campaigns within days of disclosure), defenders should treat this as a near-term priority even without KEV confirmation. The only mitigating uncertainty is install base, which is not provided. |
| Exploit ScenarioDerived | An attacker scans the internet for WordPress sites running the Datalogics Ecommerce Delivery plugin (fingerprintable via /wp-content/plugins/datalogics/ asset paths), then sends a crafted HTTP request to the vulnerable plugin endpoint that elevates an attacker-controlled (or newly created) account to administrator. With admin rights, the attacker uploads a malicious plugin or theme containing a PHP webshell, achieving full site takeover and pivoting to data theft, SEO spam injection, or hosting of phishing pages. No public POC is identified at time of analysis, but the CVSS AC:L/PR:N profile means weaponization is straightforward once the vulnerable code path is identified. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 15, 2026
Unauthenticated privilege escalation in the Datalogics Ecommerce Delivery WordPress plugin (versions ≤ 2.6.62) allows remote attackers to gain elevated privileges on affected WordPress sites without any credentials or user interaction. The flaw, tracked by Patchstack and assigned a CVSS 9.8, enables full compromise of site integrity and confidentiality; no public exploit identified at time of analysis, but the network-reachable, no-auth nature makes opportunistic exploitation likely once details circulate.
RemediationAI
Upstream fix availability is not independently confirmed in the provided data - the Patchstack entry references the vulnerable range (≤ 2.6.62) but no patched version is cited, so administrators should consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/datalogics/vulnerability/wordpress-datalogics-ecommerce-delivery-plugin-2-6-62-privilege-escalation-vulnerability) and the vendor's plugin page on wordpress.org for a release newer than 2.6.62, applying it immediately once available. Until a fixed version is confirmed, the safest compensating control is to deactivate and remove the Datalogics Ecommerce Delivery plugin (side effect: loss of delivery integration functionality on the storefront); short of that, restrict access to /wp-admin/admin-ajax.php and the WordPress REST API endpoints exposed by the plugin via a WAF rule or .htaccess IP allowlist (side effect: may break legitimate front-end checkout flows that rely on those endpoints), and audit wp_users / wp_usermeta for unexpected administrator-role assignments created since the plugin was installed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the Datalogics Ecommerce Delivery plugin for WordPress, a third-party extension that integrates shipping/delivery functionality into WooCommerce-style storefronts. The CWE-266 (Incorrect Privilege Assignment) classification indicates the plugin assigns privileges to a user, role, or request context that should not have them - typically because a privileged action handler is registered on a public AJAX/REST endpoint (e.g., wp_ajax_nopriv_*) or fails to call current_user_can() / verify a nonce before changing a user's role, capabilities, or meta. CPE cpe:2.3:a:datalogics:datalogics_ecommerce_delivery confirms the issue is plugin-scoped rather than a flaw in WordPress core.
Know when Datalogics Ecommerce Delivery gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated WordPress plugin endpoint reachable over the network with no user interaction; successful privilege escalation to admin yields full C/I/A compromise of the site.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Privilege Escalation in Datalogics Ecommerce Delivery <= 2.6.62 versions.
Executive ViewAI
The Datalogics Ecommerce Delivery WordPress plugin (versions ≤2.6.62) allows unauthenticated remote takeover of WordPress storefronts. With no vendor patch identified and no public exploit code available, but with zero authentication barriers, organizations face immediate and severe risk of customer data theft and business disruption as vulnerability details inevitably circulate.
Pending vendor patch release: (1) Uninstall the plugin and migrate to alternative ecommerce solution if needed; (2) Deploy WAF rules blocking plugin directory access; (3) Enforce WordPress administrative MFA and IP allowlisting; (4) Implement file integrity monitoring on WordPress directories; (5) Enable enhanced logging for administrative actions and privilege escalation attempts; (6) Isolate affected WordPress instances to segregated network segments.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Exploit-DB