CVE-2026-9613

Name of the Vulnerable Software and Affected Versions Datalogics Ecommerce Delivery – Datalogics plugin for WordPress versions prior to 2.6.66

Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Authenticated attackers with subscriber-level access or higher can leverage the store's stored authentication token to create and cancel shipping orders via an external logistics API. Additionally, attackers can modify arbitrary WooCommerce order post meta, overwrite the stored API token, and trigger shipping notification emails to customers.

Recommendations Update the Datalogics Ecommerce Delivery – Datalogics plugin for WordPress to version 2.6.66 or later.