Datalogics Ecommerce Delivery – Datalogics < 2.6.60 - Unauthenticated Privilege Escalation

Successful exploitation of CVE-2026-2631 allows an attacker to bypass standard authentication mechanisms and directly assume administrator privileges. This grants them unrestricted access to the WordPress site's backend, enabling them to modify content, install malicious plugins, steal sensitive data (user credentials, customer information, financial data), and potentially compromise the entire server. The blast radius extends beyond the WordPress site itself, as attackers can use the compromised server as a launchpad for further attacks against other systems on the network. The ease of exploitation, requiring no authentication, significantly increases the risk.

1. Reserviert2026-02-17
2. Veröffentlicht2026-03-12
3. Geändert2026-03-19
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2026-2631 is to immediately upgrade the Datalogics Ecommerce Delivery plugin to version 2.6.60 or later. If an immediate upgrade is not feasible due to compatibility issues or breaking changes, consider temporarily disabling the plugin to prevent further exploitation. While a direct workaround is unavailable, implementing strict access controls and regularly auditing user permissions can help limit the potential damage if the vulnerability is exploited. After upgrading, verify the plugin's functionality and confirm that the vulnerability has been successfully patched by attempting a login with a non-administrator user and verifying that access is denied.

Aktive Installationen

400Nische

Plugin-Bewertung

5.0

Erfordert WordPress

5.0+

Kompatibel bis

6.8.5

Erfordert PHP

7.4+