CVE-2026-39583: WordPress Datalogics Ecommerce Delivery plugin <= 2.6.62 - Privilege Escalation vulnerability

Synopsis

An unauthenticated privilege escalation vulnerability affects the Datalogics Ecommerce Delivery WordPress plugin in versions 2.6.62 and earlier. The flaw is reachable over the network with no credentials required and no user interaction needed, making it trivially exploitable by any remote attacker. Successful exploitation allows a remote attacker to escalate to administrative or otherwise elevated privileges, enabling full read, write, and availability impact on the affected WordPress installation. No fix version has been published; HarborGuard is tracking the advisory and will make a patched rebuild available as soon as an upstream fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the WordPress service over the network; no local or physical access is needed.

• AuthenticationNot required

  No credentials of any kind are required; the vulnerability is fully unauthenticated.

• Victim interactionNot required

  The attacker does not need any victim to click a link or take any action to trigger exploitation.

• Attack complexityDetail

  Exploit conditions are straightforward and reliable, with no race conditions or special environmental factors required.

Blast Radius

• A successful attacker gains elevated or administrative privileges on the WordPress installation without any prior account.
• With escalated privileges, the attacker reads all stored site data, including customer records, order details, and session tokens.
• The attacker modifies or deletes site content, plugin configuration, user accounts, and persisted database rows.
• The attacker disrupts or fully disables the WordPress site, taking the ecommerce delivery functionality offline.