This vulnerability (CVE-2026-66692) is classified as CWE-639, indicating an authorization bypass via user-controlled keys in the Colissimo Officiel : Méthodes de livraison pour WooCommerce plugin. Specifically, it involves insecure direct object references (IDOR) in versions up to 2.10.0, allowing attackers with low privileges to potentially access restricted information. The CVSS 3.1 base score is 4.3 (medium), reflecting network attack vector, low complexity, required privileges, no user interaction, and limited confidentiality impact. No patch or official remediation level has been disclosed as of the publication date.

An attacker with low privileges could exploit this vulnerability to bypass authorization controls and access or manipulate data that should be restricted. The impact is limited to confidentiality loss without integrity or availability effects. There is no evidence of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected plugin and monitor for unusual activity related to delivery method configurations. Avoid exposing user-controlled keys to untrusted users.