CVE-2026-9240

Name of the Vulnerable Software and Affected Versions Colissimo Officiel : Méthodes de livraison pour WooCommerce versions prior to 2.9.1

Description Authenticated users with Subscriber-level access and above can perform unauthorized modification of data. The issue exists because the updateShippingMethod() function, registered to the wp ajax lpc order affect AJAX action, fails to perform a current user can() capability check and lacks nonce verification. This allows an attacker to provide a specific order id to modify the shipping method, pickup-point meta, and shipping address of arbitrary WooCommerce orders, including those belonging to other users.

Recommendations Update to a version newer than 2.9.0. As a temporary workaround, restrict access to the updateShippingMethod() function until a patch is applied.