Unauthorized Data Modification in Colissimo Officiel Plugin for WooCommerce

CVE-2026-9240

What is CVE-2026-9240?

The Colissimo Officiel plugin for WooCommerce is susceptible to unauthorized data modification due to inadequate capability checks within its updateShippingMethod() function. This vulnerability originates from the absence of user capability verification and nonce checks, allowing authenticated users with Subscriber-level access or higher to modify critical shipping details. Attackers can manipulate shipment data such as shipping methods, pickup points, and addresses for any WooCommerce order, including those belonging to other users, leading to potential misuse and disruption of service.

References