CVE-2026-9240— Colissimo Officiel : Méthodes de livraison pour WooCommerce <= 2.9.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Order Shipment Modification via lpc_order_affect AJAX action
Affected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| iscpcolissimo | Colissimo shipping methods for WooCommerce | ≤ 2.9.0 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-9240
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Colissimo Officiel : Méthodes de livraison pour WooCommerce <= 2.9.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Order Shipment Modification via lpc_order_affect AJAX action
Source: CVE Program / CVE List V5
Vulnerability Description
The Colissimo Officiel : Méthodes de livraison pour WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the updateShippingMethod() function (registered to the wp_ajax_lpc_order_affect AJAX action) in versions up to, and including, 2.9.0. This is due to the handler performing no current_user_can() capability check and no nonce verification before reading an attacker-supplied order_id and modifying that order's shipping method, pickup-point meta, and shipping address. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create or modify the shipment information (shipping method, pickup relay data, and shipping address) of arbitrary WooCommerce orders, including orders placed by other users.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5
Vulnerability Title
WordPress Colissimo shipping methods for WooCommerce 授权问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
WordPress Colissimo shipping methods for WooCommerce是WordPress基金会的一款为WooCommerce提供法国Colissimo物流配送方式集成与运费计算的配送插件。 WordPress Colissimo shipping methods for WooCommerce 2.9.0及之前版本存在授权问题漏洞，该漏洞源于updateShippingMethod()函数缺少权限检查，可能导致已通过身份验证的攻击者（具有订阅者级别及以上权限）修改任意W
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| iscpcolissimo | Colissimo shipping methods for WooCommerce | 0 ~ 2.9.0 | - |
II. Public POCs for CVE-2026-9240
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-9240
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-9240 (2)
Vendor Advisories for CVE-2026-9240 (1)
Security Blog Posts for CVE-2026-9240 (1)
Other References for CVE-2026-9240 (1)
IV. Related Vulnerabilities
Same weakness: CWE-862
- CVE-2026-66589
WordPress B2BKing plugin <= 5.2.30 - Broken Access Control v - CVE-2026-12631
Broken access-control denial in k_thread_join/k_thread_abort - CVE-2026-53453
Blueprint Studio API authorization bypass for non-admin Home - CVE-2026-67443
FUXA: Unauthenticated guest JWT bypasses Node-RED secure-mod - CVE-2026-67440
FUXA: Unauthenticated Socket.IO read events
V. Comments for CVE-2026-9240
No comments yet