Authorization Bypass in Datalogics Ecommerce Delivery WordPress Plugin

Publication date: 2026-09-19

Last updated on: 2026-09-19

Assigner: Wordfence

Description

The Datalogics Ecommerce Delivery – Datalogics plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.65. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to create and cancel real shipping orders through the external logistics API using the store's stored authentication token, modify arbitrary WooCommerce order post meta on any order, overwrite the plugin's stored API token, and trigger shipping notification emails to customers.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-19

Last Modified

2026-09-19

Generated

2026-09-20

AI Q&A

2026-09-20

EPSS Evaluated

N/A

NVD

CVE-2026-9613

Affected Vendors & Products

Vendor	Product	Version / Range
datalogics	datalogics_ecommerce_delivery	to 2.6.65 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

The Datalogics Ecommerce Delivery plugin for WordPress has an authorization bypass vulnerability in versions up to 2.6.65. This flaw allows authenticated users with subscriber-level access or higher to bypass permission checks and perform unauthorized actions such as creating or canceling shipping orders, modifying order metadata, overwriting API tokens, and sending shipping notifications to customers.

Impact Analysis

This vulnerability could allow attackers to manipulate orders, steal customer data via shipping notifications, or disrupt store operations by canceling valid orders. Businesses using the plugin risk financial loss, reputational damage, and potential data breaches if exploited.

Mitigation Strategies

Update the Datalogics Ecommerce Delivery plugin to the latest version beyond 2.6.65 to address the authorization bypass issue. If an update is not available, consider disabling the plugin temporarily until a patch is released.

Hi! I’m here to help you understand CVE-2026-9613. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70