CVE-2026-9240: Colissimo WooCommerce Plugin Unauthorized Shipping Data Modification

Technical summary

CVE-2026-9240 affects the Colissimo Officiel plugin (versions ≤2.9.0) via the wp_ajax_lpc_order_affect AJAX action. The updateShippingMethod() function accepts user-supplied order_id parameters without verifying the current user's capability (current_user_can() check) or validating a nonce. An authenticated attacker can POST to the AJAX handler with an arbitrary order ID and modify the corresponding order's shipping method, pickup-point metadata, and shipping address fields. The attack requires network access and prior authentication but no interaction from the victim, and succeeds against any order regardless of ownership.

Business impact

WooCommerce stores relying on this plugin face operational and customer service disruption. Attackers could redirect customer orders to wrong addresses or pickup locations, causing fulfillment failures, customer complaints, and potential revenue loss from failed deliveries. For merchants using Colissimo international shipping, this could also create customs or compliance issues if addresses are altered. The ability for low-privilege users (including staff with Subscriber roles) to make these changes increases insider risk and complicates audit trails.

Affected systems

WordPress sites running the Colissimo Officiel : Méthodes de livraison pour WooCommerce plugin version 2.9.0 and earlier are affected. Any WooCommerce order in such installations is at risk if any user with Subscriber-level access or higher is present—including shop customers, if customer accounts are enabled. The vulnerability does not require administrator or shop manager privileges to exploit.

Exploitability

Exploitability is straightforward for attackers with valid credentials. No complex logic, no race conditions, and no special network positioning is required. The AJAX endpoint is accessible to any authenticated user. An attacker needs only to craft a POST request with a valid order ID and new shipping parameters. No public exploit code is documented, and active exploitation in the wild is not currently tracked in the KEV catalog; however, the ease of execution means defensive preparation is important.

Remediation

Upgrade the Colissimo Officiel plugin to a patched version (verify against the vendor advisory for the exact version number). After patching, audit recent order modifications to identify unauthorized shipping changes. Reduce the number of users with Subscriber-level access if not necessary for business operations, and consider restricting shop customer account creation. Review access logs for the wp_ajax_lpc_order_affect action to detect suspicious activity.

Patch guidance

Check the Colissimo Officiel plugin's official repository or vendor advisory for version 2.9.1 or later (verify the exact patched version against the official source). Apply the update through the WordPress plugin management interface, test in a staging environment first to ensure no order processing conflicts, and then deploy to production. Enable automatic security updates for this and other plugins to prevent future missed patches.

Detection guidance

Monitor for POST requests to /wp-admin/admin-ajax.php with action=lpc_order_affect originating from non-administrator IP addresses or user accounts. Log and alert on modifications to the _lpc_pickup_point and _lpc_delivery_address post meta fields on orders. Review WooCommerce order audit logs for shipping method changes made by Subscriber-level users. In SIEM systems, flag any order modification event where the user who made the change differs from the order's original customer.

Why prioritize this

Although the CVSS score is 4.3 (MEDIUM), the vulnerability warrants rapid remediation because it affects fulfillment operations directly, requires minimal attacker skill, and impacts all orders in scope. The low barrier to entry (Subscriber access) and lack of administrative capability checks make it attractive to insider threats or compromised low-privilege accounts. Stores processing high transaction volumes or operating internationally face greater disruption risk.

Risk score, explained

CVSS 3.1 score of 4.3 reflects a network-accessible, low-complexity attack requiring only authenticated access with no user interaction needed. The integrity impact is rated low because the attacker modifies shipping metadata, not order content or payment data. However, the score does not capture operational impact (fulfillment disruption, customer trust) or the insider threat angle posed by low-privilege users. Organizations processing Colissimo shipments should consider this a higher operational priority than the base CVSS suggests.

Frequently asked questions