CVE-2026-2631

Datalogics Ecommerce Delivery < 2.6.60 - Unauthenticated Privilege Escalation

The Datalogics Ecommerce Delivery WordPress plugin before 2.6.60 exposes an unauthenticated REST endpoint that allows any remote user to modify the option `datalogics_token` without verification. This token is subsequently used for authentication in a protected endpoint that allows users to perform arbitrary WordPress `update_option()` operations. Attackers can use this to enable registartion and to set the default role as Administrator.

Affected

Datalogics Ecommerce Delivery

CVSS v3.1 CNA

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.83% chance of exploitation in the next 30 days, 57th percentile

Published

2026-03-11

Proof-of-concept exploits (2)

• https://wpscan.com/vulnerability/c6a64f26-4007-49a1-aa69-1e3c50223ac7/
• Nxploited/CVE-2026-26313★ · 2026-03-20

References

• CVE Record
• NVD entry