# CVE-2026-57341: Colissimo WooCommerce Plugin IDOR in Shipping Methods

Source: https://junglewise.ai/threats/cve-2026-57341-colissimo-woocommerce-plugin-idor-in-shipping-methods  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-29. Updated: 2026-06-29  
License: CC BY 4.0 with a link back

CVE-2026-57341 · Severity: medium · CVSS 6.5 · Published 2026-06-29

A security vulnerability exists in the Colissimo shipping plugin for WooCommerce, which is used by online stores to manage delivery methods. An unauthorized person could potentially manipulate data or interact with the store's database by exploiting a flaw in how the plugin identifies specific objects or records. This could lead to unauthorized changes to shipping information or disruption of order processing.

Technologies: [Colissimo Officiel : Méthodes de livraison pour WooCommerce](https://junglewise.ai/threats/technologies/colissimo-officiel-m-thodes-de-livraison-pour-woocommerce). Vendors: [Colissimo](https://junglewise.ai/threats/vendors/colissimo).

## Quick answers

**Is CVE-2026-57341 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-57341 being exploited in the wild.

**How severe is CVE-2026-57341?** Medium severity, with a CVSS score of 6.5, published 29 June 2026.

**Which products and versions are affected?** Colissimo Officiel : Méthodes de livraison pour WooCommerce <= 2.9.0.

**Is there a fix for CVE-2026-57341?** A patch was published on 2026-06-29: Version 2.10.0 released to address the issue Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-57341 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-57341?** Check whether you run Colissimo Officiel : Méthodes de livraison pour WooCommerce at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An Insecure Direct Object Reference (IDOR) vulnerability (CWE-639) exists in the Colissimo Officiel : Méthodes de livraison pour WooCommerce plugin for WordPress. The flaw allows an unauthenticated remote attacker to bypass authorization checks by providing a user-controlled key to access or modify internal objects. According to the CVSS vector, this can lead to low-impact integrity and availability issues, potentially allowing attackers to interact with the database or sensitive files without proper credentials. The vulnerability is addressed in version 2.10.0.

## Affected products

- Colissimo Colissimo Officiel : Méthodes de livraison pour WooCommerce <= 2.9.0

## Timeline

- 2026-04-29: other: Reported by HieuPenguinnn
- 2026-06-29: disclosed: Published by Patchstack and NVD
- 2026-06-29: patched: Version 2.10.0 released to address the issue

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/wordpress/plugin/colissimo-shipping-methods-for-woocommerce/vulnerability/wordpress-colissimo-officiel-methodes-de-livraison-pour-woocommerce-plugin-2-9-0-insecure-direct-object-references-idor-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/colissimo-shipping-methods-for-woocommerce/vulnerability/wordpress-colissimo-officiel-methodes-de-livraison-pour-woocommerce-plugin-2-9-0-insecure-direct-object-references-idor-vulnerability?_s_id=cve)

## Related threats

- [Colissimo WooCommerce Plugin Unauthorized Data Modification](https://junglewise.ai/threats/cve-2026-9240-colissimo-woocommerce-plugin-unauthorized-data-modification)