PT-2026-24588 · Undefined · Undefined

Khaled Alenazi · Published 2026-03-11 · Updated 2026-03-26 · CVE-2026-2631

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Datalogics Ecommerce Delivery WordPress plugin versions prior to 2.6.60

Description The Datalogics Ecommerce Delivery WordPress plugin before version 2.6.60 has an unauthenticated REST endpoint that allows remote users to modify the datalogics token option without authentication. This token is then used to authenticate requests to a protected endpoint, enabling arbitrary WordPress update option() operations. An attacker can leverage this to enable registration and set the default user role to Administrator. The affected plugin exposes an unauthenticated REST endpoint. The vulnerable parameter is datalogics token.

Recommendations Update the Datalogics Ecommerce Delivery WordPress plugin to version 2.6.60 or later.

Exploit

Fix

LPE

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2026-2631

Affected Products

Undefined

References · 9

• 🔥 https://wpscan.com/vulnerability/c6a64f26-4007-49a1-aa69-1e3c50223ac7 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-2631 · Security Note
• https://twitter.com/Nxploited/status/2036111040534958127 · Twitter Post
• https://twitter.com/MNovofastovsky/status/2037123899935383681 · Twitter Post
• https://twitter.com/CVEnew/status/2033194320522793332 · Twitter Post
• https://t.me/CVEtracker/47099 · Telegram Post
• https://twitter.com/TheHackerWire/status/2031780071695061164 · Twitter Post
• https://twitter.com/Brinztech_com/status/2035363305741484175 · Twitter Post
• https://twitter.com/ptdbugs/status/2035994108209066491 · Twitter Post