CVE-2026-2631 — Datalogics Ecommerce Delivery < 2.6.60 - Unauthenticated Privilege Escalation
The Datalogics Ecommerce Delivery WordPress plugin before 2.6.60 exposes an unauthenticated REST endpoint that allows any remote user to modify the option `datalogics_token` wi…
Published: 2026-03-11 · CVSS: 9.8 · CVSS 3.1
The Datalogics Ecommerce Delivery WordPress plugin before 2.6.60 exposes an unauthenticated REST endpoint that allows any remote user to modify the option `datalogics_token` without verification. This token is subsequently used for authentication in a protected endpoint that allows users to perform arbitrary WordPress `update_option()` operations. Attackers can use this to enable registartion and to set the default role as Administrator.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7