ALD Dropshipping CVE-2026-103685

Exploitation requires an attacker to already hold a valid low-privilege authenticated account on the target WordPress/WooCommerce site (PR:L), which is the primary limiting factor - sites that do not permit untrusted user registration sharply reduce exposure. The vulnerable condition is the plugin's missing authorization/capability check on one or more of its endpoints (CWE-862), allowing a logged-in user to invoke functionality or modify data beyond their assigned role. Affected deployments are those running ALD - Dropshipping and Fulfillment for AliExpress and WooCommerce (woo-alidropship) from n/a through version 2.2.4; no specific non-default feature toggle is named in the description. No user interaction is required (UI:N).

This is a genuinely low-to-moderate priority issue despite being network-exploitable. The provided CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) scores 4.3 (Medium) and is internally consistent with a Missing Authorization (CWE-862) flaw: the attacker reaches the vulnerable endpoint over the network (AV:N) with low complexity (AC:L) but must already hold a low-privilege authenticated account (PR:L) on the WordPress site. Impact is limited to a low integrity effect (I:L) with no confidentiality or availability consequence (C:N/A:N), meaning an authenticated low-privilege user can perform an action or modify data they should not be authorized to touch, rather than achieving data theft or takeover. No EPSS score, CISA KEV listing, POC reference, or SSVC decision data was provided in the input, so there is no signal of active or probable exploitation - the only corroborating source is the Patchstack database entry. The signals are not conflicting; they consistently point to a bounded broken-access-control issue requiring prior authentication, not a critical mass-exploitation candidate. Priority should be routine patching rather than emergency response.

An attacker who has obtained a low-privilege authenticated account on a WooCommerce store running the ALD plugin (for example a subscriber or customer account) sends a crafted request to a plugin endpoint that fails to verify the caller's authorization, performing a state-changing action reserved for higher-privileged users. Because CVSS specifies AV:N/AC:L/PR:L/UI:N, exploitation is remote and requires no user interaction but does require that pre-existing low-privilege login. No public exploit code was identified in the provided data.