Datalogics Ecommerce Delivery Datalogics
Monthly
Authorization bypass in the Datalogics Ecommerce Delivery plugin for WordPress (all versions up to and including 2.6.65) lets any authenticated subscriber-level user exercise store-owner functions that should require higher privileges: creating and cancelling real shipping orders through the external logistics provider using the store's stored API token, rewriting arbitrary WooCommerce order post meta on any order, overwriting the plugin's own stored API token, and firing shipping-notification emails to customers. The issue is rated CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), so the impact is integrity-only and limited to business-logic abuse rather than code execution. It requires only a low-privilege WordPress account plus a site running WooCommerce with the plugin and a configured logistics API token; no public exploit code has been identified at time of analysis and there is no confirmed active exploitation (not in CISA KEV), though stores with open subscriber registration carry the greatest exposure.
Authorization bypass in the Datalogics Ecommerce Delivery plugin for WordPress (all versions up to and including 2.6.65) lets any authenticated subscriber-level user exercise store-owner functions that should require higher privileges: creating and cancelling real shipping orders through the external logistics provider using the store's stored API token, rewriting arbitrary WooCommerce order post meta on any order, overwriting the plugin's own stored API token, and firing shipping-notification emails to customers. The issue is rated CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), so the impact is integrity-only and limited to business-logic abuse rather than code execution. It requires only a low-privilege WordPress account plus a site running WooCommerce with the plugin and a configured logistics API token; no public exploit code has been identified at time of analysis and there is no confirmed active exploitation (not in CISA KEV), though stores with open subscriber registration carry the greatest exposure.