Description

Customer Insecure Direct Object References (IDOR) in Colissimo Officiel : Méthodes de livraison pour WooCommerce <= 2.10.0 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-06T15:17:22.357Z",
  "pubdate": "2026-08-06T15:17:22.357Z",
  "executiveSummary": "An Insecure Direct Object Reference (IDOR) vulnerability has been identified in the Colissimo Officiel : Méthodes de livraison pour WooCommerce plugin, affecting versions up to and including 2.10.0.\nThe vulnerability exposes sensitive customer order and delivery data by failing to properly validate authorization checks when direct object references are requested.\nAn unauthenticated or low-privileged remote attacker can exploit this flaw to manipulate object references in requests, enabling unauthorized access to confidential customer information associated with WooCommerce transactions handled by the affected product.\nThe risk implication is severe, as it compromises data confidentiality and can lead to mass exposure of personally identifiable information (PII) belonging to customers.\nSuccessful exploitation requires the attacker to craft specific requests targeting vulnerable endpoints within the plugin, leveraging predictable or enumerable object identifiers without requiring elevated privileges.",
  "technicalDetails": "The root cause of the vulnerability stems from inadequate access control implementation within the Colissimo Officiel : Méthodes de livraison pour WooCommerce plugin <= 2.10.0.\nSpecifically, the vulnerable component fails to adequately verify whether the user initiating the request possesses the necessary authorization to access specific shipping or order objects referenced by parameters in the request.\nThis represents a classic Insecure Direct Object Reference (IDOR) flaw where input parameters supplied by the client are directly utilized to retrieve backend data structures without enforcing proper session ownership or capability checks.\nThe attack flow proceeds as follows: An attacker identifies an endpoint handled by the plugin that accepts an object identifier, such as an order ID, shipment reference, or internal resource handle.\nThe attacker then issues an HTTP request to the vulnerable endpoint while substituting the legitimate identifier with an arbitrary or sequentially incremented value.\nBecause the server-side application logic lacks robust authorization verification, it processes the request and returns the requested data corresponding to the manipulated identifier.\nThe network exposure is broad, as the affected endpoints are typically accessible over standard HTTP/HTTPS protocols via the web interface of the WordPress site running WooCommerce.\nDepending on the specific implementation, exploitation may be performed by remote attackers without authentication or with low-privileged subscriber/customer accounts.\nPost-exploitation impact includes unauthorized data harvesting of customer details, shipping addresses, order statuses, and potentially other sensitive transactional metadata managed by the Colissimo shipping module.\nThe vulnerability mechanism highlights a failure in the application's authorization layer, allowing horizontal or vertical privilege escalation concerning data retrieval."
}