Vulnerability · Published Mar 11, 2026 · Assigned by WPScan

CVE-2026-2631Datalogics Ecommerce Delivery < 2.6.60 - Unauthenticated Privilege Escalation

Critical 9.8

In plain English

A critical-severity privilege mismanagement in Datalogics Ecommerce Delivery from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 51% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)0.6%top 49.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack tooling1Public PoC

Official description

The Datalogics Ecommerce Delivery WordPress plugin before 2.6.60 exposes an unauthenticated REST endpoint that allows any remote user to modify the option `datalogics_token` without verification. This token is subsequently used for authentication in a protected endpoint that allows users to perform arbitrary WordPress `update_option()` operations. Attackers can use this to enable registartion and to set the default role as Administrator.

Affected products (as reported)

Vendor	Product	Versions
Unknown	Datalogics Ecommerce Delivery	0 – before 2.6.60

Weakness: CWE-269 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://wpscan.com/vulnerability/c6a64f26-4007-49a1-aa69-1e3c50223ac7/ exploit, vdb-entry, technical-description