AUGUST 4, 2026
Live Feed
Back to database
Case File

CVE-2026-2631

CRITICAL · CVSS 9.8 EPSS 0.58%

Source: NVD + CISA KEV + EPSS (historical backfill) · Published 2026-03-11 · Last synced 2026-08-04

CyberRota Analysis

This is a critical severity vulnerability with a CVSS score of 9.8. It affects WordPress. It may be remotely exploitable.

CVE
CVE-2026-2631
Severity
CRITICAL
CVSS
9.8
EPSS
0.58%
WordPress

Original NVD Description

The Datalogics Ecommerce Delivery WordPress plugin before 2.6.60 exposes an unauthenticated REST endpoint that allows any remote user to modify the option `datalogics_token` without verification. This token is subsequently used for authentication in a protected endpoint that allows users to perform arbitrary WordPress `update_option()` operations. Attackers can use this to enable registartion and to set the default role as Administrator.