CVE-2026-57341: Unauthenticated IDOR in Colissimo Officiel WooCommerce Plugin

Technical summary

CVE-2026-57341 is an unauthenticated IDOR vulnerability (CWE-639) in the Colissimo Officiel WooCommerce plugin affecting versions up to 2.9.0. The vulnerability stems from insufficient access controls on endpoints handling delivery methods and shipping data. An attacker can craft requests with sequential or predictable object identifiers to access or modify shipping records without prior authentication or authorization. The CVSS 3.1 score of 6.5 (Medium) reflects the integrity and availability impact—while confidentiality is not compromised, attackers can alter shipping instructions or delivery selections affecting order fulfillment.

Business impact

This vulnerability poses operational and customer trust risks for WooCommerce stores using Colissimo Officiel for French and international shipping. Attackers could redirect shipments, modify delivery addresses, or change shipping methods on legitimate orders, leading to failed deliveries, customer disputes, and potential fraud. For high-volume e-commerce operations, widespread exploitation could disrupt fulfillment workflows. The reputational damage from compromised order integrity and delivery failures may exceed the direct operational cost of remediation.

Affected systems

The Colissimo Officiel WooCommerce plugin in versions 2.9.0 and earlier is affected. Any WooCommerce installation with this plugin active and accessible over the network is vulnerable. Installations of versions 2.9.1 and later are not affected, assuming they have been updated. Custom or forked versions of the plugin should be assessed individually.

Exploitability

Exploitation is straightforward and requires no authentication, credentials, or user interaction. An attacker needs only network access to the WooCommerce site and basic knowledge of HTTP request manipulation. Payloads are likely discoverable through standard enumeration of API endpoints or order identifiers. No complex technical skills, zero-days, or specialized tools are necessary. The low complexity and unauthenticated nature make this vulnerability attractive for opportunistic exploitation at scale.

Remediation

Immediately update the Colissimo Officiel plugin to a patched version beyond 2.9.0. Verify the update is applied and the plugin is reactivated. If an immediate patch is unavailable, disable or uninstall the plugin and switch to an alternative shipping solution until a fix is released. Post-remediation, audit shipping records and order logs for unauthorized modifications dating back to plugin installation or the last known secure baseline.

Patch guidance

Apply the latest version of the Colissimo Officiel plugin released after the vulnerability disclosure. Consult the plugin's official repository or vendor advisory for the specific patched version number and deployment instructions. Test the update in a staging environment before production deployment to ensure compatibility with your WooCommerce version and other active plugins. Monitor plugin release notes for security advisories going forward.

Detection guidance

Monitor WooCommerce access logs for requests to shipping and delivery-related endpoints with unusual parameter patterns or sequential object identifiers. Look for GET or POST requests to API endpoints containing numeric IDs that differ from the authenticated user's own orders. Implement Web Application Firewall (WAF) rules to block requests lacking proper authentication headers or session tokens on sensitive endpoints. Use WooCommerce audit logging plugins to track modifications to order shipping data and cross-reference against legitimate user actions.

Why prioritize this

Although rated CVSS 6.5 (Medium), this vulnerability warrants prompt attention due to its zero-friction exploitation path—no authentication required and trivial to weaponize. Unauthenticated IDOR vulnerabilities targeting order and fulfillment data create direct operational and customer-facing risks. The lack of KEV designation does not diminish urgency; focus on rapid patching rather than waiting for exploitation evidence in the wild.

Risk score, explained

The CVSS 3.1 score of 6.5 reflects Medium severity driven by integrity and availability impacts (the vector shows no confidentiality loss, partial integrity and availability impact). The Network attack vector (AV:N), Low complexity (AC:L), and No privileges required (PR:N) boost the practical risk, as exploitation is trivial and widespread. The score appropriately penalizes the unauthenticated nature but does not capture the operational and reputational consequences to e-commerce sites, which may warrant higher business-level prioritization despite the numerical rating.

Frequently asked questions