The vulnerability is caused by an unauthenticated REST endpoint in the Datalogics Ecommerce Delivery plugin that allows any remote user to modify the critical option datalogics_token without verification. This token is later used for authentication in a protected endpoint that allows arbitrary WordPress update_option() operations. An attacker can therefore enable user registration, set the default role to Administrator, and gain unrestricted administrative privileges. The consequence is full privilege escalation, enabling the attacker to modify site settings, user roles, install plugins or themes, and potentially compromise the entire WordPress installation.

All WordPress installations that use the Datalogics Ecommerce Delivery plugin with a version earlier than 2.6.60 are affected. The plugin is identified as Unknown:Datalogics Ecommerce Delivery.

The CVSS score is 9.8, indicating critical severity. EPSS is below 1%, implying that current exploit prevalence is low, but the vulnerability is still highly dangerous. It is not listed in the CISA KEV catalog. Exploitation only requires unauthenticated access to the website’s REST API; attackers can send arbitrary requests to set datalogics_token and then invoke the protected option update endpoint, resulting in privilege escalation.