Executive brief
A vulnerability in the Colissimo shipping plugin for WooCommerce allows unauthorized users to modify order details. This plugin is used by e-commerce sites to manage delivery methods and shipping labels. An attacker with a basic user account could change shipping addresses and delivery methods for any order on the site, potentially redirecting packages or disrupting business operations.
Technical details
The Colissimo Officiel plugin for WordPress fails to perform authorization checks and nonce verification in the updateShippingMethod() function, which is tied to the wp_ajax_lpc_order_affect AJAX action. This missing capability check (current_user_can) allows authenticated attackers with Subscriber-level permissions or higher to modify order metadata. By supplying an arbitrary order_id, an attacker can change the shipping method, pickup-point metadata, and shipping address of any WooCommerce order. The issue is present in versions up to and including 2.9.0.
Affected products
- Colissimo Colissimo Officiel : Méthodes de livraison pour WooCommerce up to, and including, 2.9.0
Timeline
- 2026-07-09: disclosed
- 2026-07-09: advisory
References
- https://plugins.trac.wordpress.org/browser/colissimo-shipping-methods-for-woocommerce/tags/2.9.0/admin/orders/lpc_admin_order_affect.php
- https://plugins.trac.wordpress.org/browser/colissimo-shipping-methods-for-woocommerce/tags/2.9.0/admin/orders/lpc_admin_order_affect.php
- https://plugins.trac.wordpress.org/browser/colissimo-shipping-methods-for-woocommerce/tags/2.9.0/admin/orders/lpc_admin_order_affect.php
- https://plugins.trac.wordpress.org/changeset?reponame=&old=3553367%40colissimo-shipping-methods-for-woocommerce&new=3553367%40colissimo-shipping-methods-for-woocommerce
- https://www.wordfence.com/threat-intel/vulnerabilities/id/16041d22-51ff-4fa4-99fb-20a60b557634?source=cve