CVE-2026-2631: Datalogics Ecommerce Auth Bypass Flaw

CVE-2026-2631 Overview

CVE-2026-2631 affects the Datalogics Ecommerce Delivery WordPress plugin in versions before 2.6.60. The plugin exposes an unauthenticated REST endpoint that lets any remote user modify the datalogics_token option without verification. A second protected endpoint then accepts that attacker-controlled token to authenticate arbitrary update_option() calls. Attackers can enable user registration and set the default role to Administrator, gaining full control of the WordPress site. The flaw maps to [CWE-269] (Improper Privilege Management) and is exploitable over the network without authentication or user interaction.

Critical Impact
Unauthenticated attackers can take over any affected WordPress site by setting the default registration role to Administrator and registering an admin account.

Affected Products

Datalogics Ecommerce Delivery WordPress plugin versions before 2.6.60
WordPress installations with the vulnerable plugin activated
Any site exposing the plugin's REST API endpoints to the internet

Discovery Timeline

2026-03-11 - CVE-2026-2631 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2026-2631

Vulnerability Analysis

The Datalogics Ecommerce Delivery plugin registers two REST API endpoints with a broken authentication design. The first endpoint accepts unauthenticated requests and writes attacker-supplied data into the datalogics_token WordPress option. The second endpoint reads that same option as its shared-secret authentication value before allowing privileged actions.

This design lets an attacker overwrite the secret used to authorize the second endpoint, then immediately reuse that secret to invoke it. The protected endpoint wraps arbitrary calls to WordPress's update_option() function, giving the attacker write access to any site option.

With arbitrary update_option() access, an attacker sets users_can_register to 1 and changes default_role to administrator. Registering through /wp-login.php?action=register then provisions an attacker-controlled administrator account.

Root Cause

The root cause is improper privilege management [CWE-269] in the plugin's REST route registration. The token-setting endpoint lacks a permission_callback that validates the caller, and the protected endpoint uses a mutable option as its sole authentication factor instead of WordPress capabilities or nonces.

Attack Vector

Exploitation requires only network access to the target site's REST API. The attacker issues an HTTP request to the unauthenticated endpoint to set datalogics_token to a known value. The attacker then calls the protected endpoint with that token to invoke update_option() and enable administrator self-registration. No prior credentials, social engineering, or user interaction are required.

For full technical details, see the WPScan Vulnerability Report.

Detection Methods for CVE-2026-2631

Indicators of Compromise

Unexpected changes to the datalogics_token value in the wp_options table
WordPress users_can_register option flipped to 1 and default_role changed to administrator
New administrator accounts created through /wp-login.php?action=register from unfamiliar IP addresses
POST requests to the plugin's REST routes under /wp-json/ from unauthenticated clients

Detection Strategies

Audit the wp_options table for unauthorized modifications to datalogics_token, users_can_register, and default_role
Review web server logs for unauthenticated POST requests to Datalogics plugin REST endpoints
Correlate option changes with subsequent user registrations occurring within a short time window
Inventory installed plugins and flag any Datalogics Ecommerce Delivery instance below version 2.6.60

Monitoring Recommendations

Forward WordPress audit logs and web access logs to a centralized SIEM for correlation
Alert on any creation of administrator accounts outside change-management windows
Monitor REST API traffic volume and source diversity for the affected plugin paths
Track plugin version inventory across managed WordPress sites and alert on outdated installs

How to Mitigate CVE-2026-2631

Immediate Actions Required

Update the Datalogics Ecommerce Delivery plugin to version 2.6.60 or later on all WordPress sites
Disable user registration and reset default_role to subscriber if changes are not expected
Audit existing administrator accounts and remove any that were not created by authorized personnel
Rotate credentials and session tokens for all administrator accounts after patching

Patch Information

The vendor addressed CVE-2026-2631 in Datalogics Ecommerce Delivery version 2.6.60. Upgrade through the WordPress plugin dashboard or by replacing the plugin files via WP-CLI or SFTP. Verify the installed version after update by checking the plugin metadata. See the WPScan Vulnerability Report for advisory details.

Workarounds

Deactivate and remove the Datalogics Ecommerce Delivery plugin until it can be updated to 2.6.60
Block external access to /wp-json/ routes belonging to the plugin using a web application firewall
Restrict the WordPress REST API to authenticated users at the reverse proxy or WAF layer
Set users_can_register to 0 in wp_options to prevent administrator account creation via the registration flow

bash

# Configuration example
wp plugin update datalogics-ecommerce-delivery --version=2.6.60
wp option update users_can_register 0
wp option update default_role subscriber
wp user list --role=administrator --fields=ID,user_login,user_email,user_registered