CVE-2026-9240 describes a missing authorization vulnerability (CWE-862) in the Colissimo Officiel plugin for WooCommerce. The updateShippingMethod() function, triggered by the wp_ajax_lpc_order_affect AJAX action, lacks a current_user_can() capability check and nonce verification. As a result, authenticated attackers with minimal privileges can supply an order_id and modify shipment information of orders they do not own. This vulnerability affects all versions up to and including 2.9.0 of the plugin.

An attacker with Subscriber-level or higher access can alter shipping methods, pickup relay data, and shipping addresses of arbitrary WooCommerce orders. This unauthorized modification can lead to order fulfillment errors, potential fraud, or disruption of shipping processes. There is no impact on confidentiality or availability reported, but integrity of order shipment data is compromised.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict user roles to trusted users only and monitor for suspicious changes to order shipment data. Avoid granting Subscriber-level or higher access to untrusted users. Follow vendor updates for an official patch or temporary fix.