PT-2026-24588 · Undefined · Undefined

Khaled Alenazi · Publicado 2026-03-11 · Atualizado 2026-03-26 · CVE-2026-2631

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Datalogics Ecommerce Delivery WordPress plugin versions prior to 2.6.60

Description The Datalogics Ecommerce Delivery WordPress plugin before version 2.6.60 has an unauthenticated REST endpoint that allows remote users to modify the datalogics token option without authentication. This token is then used to authenticate requests to a protected endpoint, enabling arbitrary WordPress update option() operations. An attacker can leverage this to enable registration and set the default user role to Administrator. The affected plugin exposes an unauthenticated REST endpoint. The vulnerable parameter is datalogics token.

Recommendations Update the Datalogics Ecommerce Delivery WordPress plugin to version 2.6.60 or later.

Exploit

Correção

LPE

Improper Privilege Management

Enumeração de Fraquezas

CWE-269

Identificadores relacionados

CVE-2026-2631

Produtos afetados

Undefined

Referências · 9

• 🔥 https://wpscan.com/vulnerability/c6a64f26-4007-49a1-aa69-1e3c50223ac7 · Exploit
• https://twitter.com/Nxploited/status/2036111040534958127 · Publicação no Twitter
• https://twitter.com/MNovofastovsky/status/2037123899935383681 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-2631 · Nota de Segurança
• https://twitter.com/CVEnew/status/2033194320522793332 · Publicação no Twitter
• https://t.me/CVEtracker/47099 · Publicação no Telegram
• https://twitter.com/TheHackerWire/status/2031780071695061164 · Publicação no Twitter
• https://twitter.com/Brinztech_com/status/2035363305741484175 · Publicação no Twitter
• https://twitter.com/ptdbugs/status/2035994108209066491 · Publicação no Twitter