Is CVE-2026-9240 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-9240 being exploited in the wild.

How severe is CVE-2026-9240?

Medium severity, with a CVSS score of 4.3, published 9 July 2026.

Which products and versions are affected?

Colissimo Officiel : Méthodes de livraison pour WooCommerce up to, and including, 2.9.0.

Is there a fix for CVE-2026-9240?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-9240 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-9240?

Check whether you run Colissimo Officiel : Méthodes de livraison pour WooCommerce at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-9240: Colissimo WooCommerce Plugin Unauthorized Data Modification

CVE-2026-9240 · Severity: medium · CVSS 4.3 · Published 2026-07-09

A vulnerability in the Colissimo shipping plugin for WooCommerce allows unauthorized users to modify order details. This plugin is used by e-commerce sites to manage delivery methods and shipping labels. An attacker with a basic user account could change shipping addresses and delivery methods for any order on the site, potentially redirecting packages or disrupting business operations.

Technologies: Colissimo Officiel : Méthodes de livraison pour WooCommerce. Vendors: Colissimo.

Quick answers

Is CVE-2026-9240 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-9240 being exploited in the wild.
How severe is CVE-2026-9240?: Medium severity, with a CVSS score of 4.3, published 9 July 2026.
Which products and versions are affected?: Colissimo Officiel : Méthodes de livraison pour WooCommerce up to, and including, 2.9.0.
Is there a fix for CVE-2026-9240?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-9240 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-9240?: Check whether you run Colissimo Officiel : Méthodes de livraison pour WooCommerce at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Colissimo Officiel plugin for WordPress fails to perform authorization checks and nonce verification in the updateShippingMethod() function, which is tied to the wp_ajax_lpc_order_affect AJAX action. This missing capability check (current_user_can) allows authenticated attackers with Subscriber-level permissions or higher to modify order metadata. By supplying an arbitrary order_id, an attacker can change the shipping method, pickup-point metadata, and shipping address of any WooCommerce order. The issue is present in versions up to and including 2.9.0.

Affected products

Colissimo Colissimo Officiel : Méthodes de livraison pour WooCommerce up to, and including, 2.9.0

Timeline

2026-07-09: disclosed
2026-07-09: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.