The Datalogics Ecommerce Delivery WordPress plugin before 2.6.60 exposes an unauthenticated REST endpoint that allows any remote user to modify the option `datalogics_token` without verification. This token is subsequently used for authentication in a protected endpoint that allows users to perform arbitrary WordPress `update_option()` operations. Attackers can use this to enable registartion and to set the default role as Administrator.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Unknown | Datalogics Ecommerce Delivery | unaffected |
|
No data.
No data.
No data.
Project Subscriptions
No data.
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Wed, 11 Mar 2026 06:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | The Datalogics Ecommerce Delivery WordPress plugin before 2.6.60 exposes an unauthenticated REST endpoint that allows any remote user to modify the option `datalogics_token` without verification. This token is subsequently used for authentication in a protected endpoint that allows users to perform arbitrary WordPress `update_option()` operations. Attackers can use this to enable registartion and to set the default role as Administrator. | |
| Title | Datalogics Ecommerce Delivery < 2.6.60 - Unauthenticated Privilege Escalation | |
| References |
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: WPScan
Published:
Updated: 2026-03-11T06:00:11.163Z
Reserved: 2026-02-17T15:27:51.784Z
Link: CVE-2026-2631
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-03-11T06:17:14.467
Modified: 2026-03-11T06:17:14.467
Link: CVE-2026-2631
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses
No weakness.