Description

The Datalogics Ecommerce Delivery – Datalogics plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.65. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to create and cancel real shipping orders through the external logistics API using the store's stored authentication token, modify arbitrary WooCommerce order post meta on any order, overwrite the plugin's stored API token, and trigger shipping notification emails to customers.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-19T09:16:35.060Z",
  "pubdate": "2026-09-19T09:16:35.060Z",
  "executiveSummary": "The Datalogics Ecommerce Delivery plugin for WordPress is susceptible to an authorization bypass vulnerability affecting all versions up to and including 2.6.65. The flaw stems from insufficient access control enforcement, which fails to validate the authorization level of the requesting user when invoking sensitive administrative or logistics-related functions.\nThis vulnerability allows authenticated users, regardless of their low-privilege status (e.g., subscribers), to interact with the plugin’s backend logic as if they possessed administrative privileges. By exploiting these broken access controls, an attacker can manipulate external shipping APIs, alter order metadata, and tamper with the plugin’s core configuration, including stored API credentials.\nThe implications of this vulnerability are severe, potentially leading to unauthorized financial costs through the creation of fraudulent shipping orders, the cancellation of legitimate customer deliveries, and the unauthorized dissemination of logistics-related notifications. Because the plugin utilizes a centralized authentication token, an attacker can hijack this identity to perform unauthorized operations against external service providers. Organizations utilizing this plugin are exposed to significant business logic abuse, data integrity risks, and potential reputational damage due to malicious order management. The exploitation is trivial, requiring only standard subscriber-level authentication within the WordPress environment.",
  "technicalDetails": "The root cause of the vulnerability is the absence of adequate capability checks within the plugin's action-handling mechanisms. WordPress plugins typically use `current_user_can()` or similar permission-validation functions to restrict access to sensitive backend tasks. In Datalogics Ecommerce Delivery 2.6.65 and earlier, these checks are either missing or incorrectly implemented, allowing any authenticated user to trigger AJAX actions or POST requests intended exclusively for administrators.\nThe exploitation flow begins with the attacker identifying the specific internal endpoints responsible for order management and API interaction. Because the application logic does not verify the user's role before executing the request, an attacker can inject malicious payloads into these requests. By iterating through order IDs, an attacker can manipulate arbitrary WooCommerce order post meta, directly altering the data structure of any store order.\nFurthermore, the vulnerability allows for the direct exploitation of the plugin's administrative configuration. Attackers can submit requests to overwrite the stored API authentication token. By replacing the legitimate store token with an attacker-controlled one, or by misconfiguring it, the attacker can effectively redirect the plugin’s communication to a rogue logistics provider or cause a denial-of-service in order processing.\nBeyond configuration tampering, the attacker can leverage the plugin's integration with the external logistics API to create or cancel shipping orders on demand. Because the plugin uses a stored authentication token to facilitate these requests, the logistics provider perceives these unauthorized requests as legitimate commands from the shop owner. The attack flow for triggering notification emails is similarly direct: by manipulating the order workflow through the exposed unauthorized endpoints, the attacker can force the system to dispatch shipping status updates, causing confusion and security concerns for the end customer.\nThe lack of server-side validation means that the application assumes the incoming request is authorized simply based on the presence of a valid session cookie, without validating the underlying user capability. This oversight turns the plugin into a vector for total administrative control over the shipping and logistics subsystem. The attack surface is internal to the application, requiring no complex network-level exploitation, only the ability to authenticate as a low-level user."
}